# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 10.06.2020 18:32:33.965 Process: id = "1" image_name = "ransomware.exe" filename = "c:\\users\\fd1hvy\\desktop\\ransomware.exe" page_root = "0xadc3000" os_pid = "0x11e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ransomware.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x11d8 [0068.862] AllocConsole () returned 1 [0076.323] GetCurrentProcessId () returned 0x11e0 [0076.323] AttachConsole (dwProcessId=0x11e0) returned 0 [0076.324] GetLastError () returned 0x5 [0076.324] lstrlenA (lpString="EMAILS : imperial755@protonmail.com \r\n imperial@mailfence.com \r\n\n") returned 66 [0076.324] LocalAlloc (uFlags=0x40, uBytes=0x243) returned 0x106a4f0 [0076.328] wvnsprintfA (in: pszDest=0x106a4f0, cchDest=578, pszFmt="EMAILS : imperial755@protonmail.com \r\n imperial@mailfence.com \r\n\n", arglist=0xcff784 | out: pszDest="EMAILS : imperial755@protonmail.com \r\n imperial@mailfence.com \r\n\n") returned 66 [0076.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x170 [0076.328] WriteFile (in: hFile=0x170, lpBuffer=0x106a4f0*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xcff758, lpOverlapped=0x0 | out: lpBuffer=0x106a4f0*, lpNumberOfBytesWritten=0xcff758*=0x42, lpOverlapped=0x0) returned 1 [0076.332] OutputDebugStringA (lpOutputString="EMAILS : imperial755@protonmail.com \r\n imperial@mailfence.com \r\n\n") [0076.334] FlushFileBuffers (hFile=0x170) returned 0 [0076.335] LocalFree (hMem=0x106a4f0) returned 0x0 [0076.335] SetLastError (dwErrCode=0x5) [0076.335] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\ransomware.exe\" " [0076.335] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1064618 [0076.335] Wow64DisableWow64FsRedirection (in: OldValue=0xcff744 | out: OldValue=0xcff744*=0x0) returned 1 [0076.335] LocalAlloc (uFlags=0x40, uBytes=0x150) returned 0x10692c8 [0076.336] CryptAcquireContextW (in: phProv=0x291208, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x291208*=0x106cfa0) returned 1 [0077.141] GetActiveWindow () returned 0x0 [0077.141] GetCapture () returned 0x0 [0077.142] GetClipboardOwner () returned 0x0 [0077.143] GetClipboardViewer () returned 0x0 [0077.143] GetCurrentProcess () returned 0xffffffff [0077.143] GetCurrentProcessId () returned 0x11e0 [0077.143] GetCurrentThread () returned 0xfffffffe [0077.143] GetCurrentThreadId () returned 0x11d8 [0077.143] GetTickCount () returned 0x11548dd [0077.143] GetDesktopWindow () returned 0x10010 [0077.144] GetFocus () returned 0x0 [0077.144] GetInputState () returned 0 [0077.144] GetMessagePos () returned 0x0 [0077.144] GetMessageTime () returned 0 [0077.144] GetOpenClipboardWindow () returned 0x0 [0077.144] GetProcessHeap () returned 0x1050000 [0077.144] GetProcessWindowStation () returned 0x12c [0077.144] GetQueueStatus (flags=0x4bf) returned 0x0 [0077.145] GetCaretPos (in: lpPoint=0xcff704 | out: lpPoint=0xcff704) returned 1 [0077.145] GetCursorPos (in: lpPoint=0xcff704 | out: lpPoint=0xcff704*(x=1093, y=79)) returned 1 [0077.145] GlobalMemoryStatus (in: lpBuffer=0xcff6bc | out: lpBuffer=0xcff6bc) [0077.145] GetCurrentThread () returned 0xfffffffe [0077.145] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0xcff6fc, lpExitTime=0xcff6f4, lpKernelTime=0xcff6ec, lpUserTime=0xcff6e4 | out: lpCreationTime=0xcff6fc, lpExitTime=0xcff6f4, lpKernelTime=0xcff6ec, lpUserTime=0xcff6e4) returned 1 [0077.145] GetCurrentProcess () returned 0xffffffff [0077.145] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0xcff6fc, lpExitTime=0xcff6f4, lpKernelTime=0xcff6ec, lpUserTime=0xcff6e4 | out: lpCreationTime=0xcff6fc, lpExitTime=0xcff6f4, lpKernelTime=0xcff6ec, lpUserTime=0xcff6e4) returned 1 [0077.145] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0xcff718, lpMaximumWorkingSetSize=0xcff714 | out: lpMinimumWorkingSetSize=0xcff718, lpMaximumWorkingSetSize=0xcff714) returned 1 [0077.146] GetStartupInfoW (in: lpStartupInfo=0xcff678 | out: lpStartupInfo=0xcff678*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x742a3e74, hStdOutput=0xcff6d8, hStdError=0xacbfb5fd)) [0077.146] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6dc | out: lpPerformanceCount=0xcff6dc*=17215488789) returned 1 [0077.146] CryptGenRandom (in: hProv=0x106cfa0, dwLen=0x140, pbBuffer=0x291228 | out: pbBuffer=0x291228) returned 1 [0077.146] GetActiveWindow () returned 0x0 [0077.146] GetCapture () returned 0x0 [0077.146] GetClipboardOwner () returned 0x0 [0077.146] GetClipboardViewer () returned 0x0 [0077.146] GetCurrentProcess () returned 0xffffffff [0077.146] GetCurrentProcessId () returned 0x11e0 [0077.146] GetCurrentThread () returned 0xfffffffe [0077.146] GetCurrentThreadId () returned 0x11d8 [0077.146] GetTickCount () returned 0x11548dd [0077.146] GetDesktopWindow () returned 0x10010 [0077.147] GetFocus () returned 0x0 [0077.147] GetInputState () returned 0 [0077.147] GetMessagePos () returned 0x0 [0077.147] GetMessageTime () returned 0 [0077.147] GetOpenClipboardWindow () returned 0x0 [0077.147] GetProcessHeap () returned 0x1050000 [0077.147] GetProcessWindowStation () returned 0x12c [0077.147] GetQueueStatus (flags=0x4bf) returned 0x0 [0077.147] GetCaretPos (in: lpPoint=0xcff6fc | out: lpPoint=0xcff6fc) returned 1 [0077.147] GetCursorPos (in: lpPoint=0xcff6fc | out: lpPoint=0xcff6fc*(x=1093, y=79)) returned 1 [0077.147] GlobalMemoryStatus (in: lpBuffer=0xcff6b4 | out: lpBuffer=0xcff6b4) [0077.147] GetCurrentThread () returned 0xfffffffe [0077.148] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0xcff6f4, lpExitTime=0xcff6ec, lpKernelTime=0xcff6e4, lpUserTime=0xcff6dc | out: lpCreationTime=0xcff6f4, lpExitTime=0xcff6ec, lpKernelTime=0xcff6e4, lpUserTime=0xcff6dc) returned 1 [0077.148] GetCurrentProcess () returned 0xffffffff [0077.148] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0xcff6f4, lpExitTime=0xcff6ec, lpKernelTime=0xcff6e4, lpUserTime=0xcff6dc | out: lpCreationTime=0xcff6f4, lpExitTime=0xcff6ec, lpKernelTime=0xcff6e4, lpUserTime=0xcff6dc) returned 1 [0077.148] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0xcff710, lpMaximumWorkingSetSize=0xcff70c | out: lpMinimumWorkingSetSize=0xcff710, lpMaximumWorkingSetSize=0xcff70c) returned 1 [0077.148] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6d4 | out: lpPerformanceCount=0xcff6d4*=17215692680) returned 1 [0077.148] CryptGenRandom (in: hProv=0x106cfa0, dwLen=0x140, pbBuffer=0x291228 | out: pbBuffer=0x291228) returned 1 [0077.148] LocalAlloc (uFlags=0x40, uBytes=0x150) returned 0x106b6b0 [0077.148] GetActiveWindow () returned 0x0 [0077.148] GetCapture () returned 0x0 [0077.148] GetClipboardOwner () returned 0x0 [0077.148] GetClipboardViewer () returned 0x0 [0077.149] GetCurrentProcess () returned 0xffffffff [0077.149] GetCurrentProcessId () returned 0x11e0 [0077.149] GetCurrentThread () returned 0xfffffffe [0077.149] GetCurrentThreadId () returned 0x11d8 [0077.149] GetTickCount () returned 0x11548dd [0077.149] GetDesktopWindow () returned 0x10010 [0077.149] GetFocus () returned 0x0 [0077.149] GetInputState () returned 0 [0077.149] GetMessagePos () returned 0x0 [0077.149] GetMessageTime () returned 0 [0077.149] GetOpenClipboardWindow () returned 0x0 [0077.149] GetProcessHeap () returned 0x1050000 [0077.149] GetProcessWindowStation () returned 0x12c [0077.149] GetQueueStatus (flags=0x4bf) returned 0x0 [0077.149] GetCaretPos (in: lpPoint=0xcff6e0 | out: lpPoint=0xcff6e0) returned 1 [0077.149] GetCursorPos (in: lpPoint=0xcff6e0 | out: lpPoint=0xcff6e0*(x=1093, y=79)) returned 1 [0077.149] GlobalMemoryStatus (in: lpBuffer=0xcff698 | out: lpBuffer=0xcff698) [0077.150] GetCurrentThread () returned 0xfffffffe [0077.150] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0 | out: lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0) returned 1 [0077.150] GetCurrentProcess () returned 0xffffffff [0077.150] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0 | out: lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0) returned 1 [0077.150] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0xcff6f4, lpMaximumWorkingSetSize=0xcff6f0 | out: lpMinimumWorkingSetSize=0xcff6f4, lpMaximumWorkingSetSize=0xcff6f0) returned 1 [0077.150] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6b8 | out: lpPerformanceCount=0xcff6b8*=17215898766) returned 1 [0077.150] CryptGenRandom (in: hProv=0x106cfa0, dwLen=0x140, pbBuffer=0x291228 | out: pbBuffer=0x291228) returned 1 [0077.150] GetActiveWindow () returned 0x0 [0077.150] GetCapture () returned 0x0 [0077.150] GetClipboardOwner () returned 0x0 [0077.150] GetClipboardViewer () returned 0x0 [0077.150] GetCurrentProcess () returned 0xffffffff [0077.150] GetCurrentProcessId () returned 0x11e0 [0077.150] GetCurrentThread () returned 0xfffffffe [0077.150] GetCurrentThreadId () returned 0x11d8 [0077.150] GetTickCount () returned 0x11548dd [0077.150] GetDesktopWindow () returned 0x10010 [0077.150] GetFocus () returned 0x0 [0077.150] GetInputState () returned 0 [0077.151] GetMessagePos () returned 0x0 [0077.151] GetMessageTime () returned 0 [0077.151] GetOpenClipboardWindow () returned 0x0 [0077.151] GetProcessHeap () returned 0x1050000 [0077.151] GetProcessWindowStation () returned 0x12c [0077.151] GetQueueStatus (flags=0x4bf) returned 0x0 [0077.151] GetCaretPos (in: lpPoint=0xcff6e0 | out: lpPoint=0xcff6e0) returned 1 [0077.151] GetCursorPos (in: lpPoint=0xcff6e0 | out: lpPoint=0xcff6e0*(x=1093, y=79)) returned 1 [0077.151] GlobalMemoryStatus (in: lpBuffer=0xcff698 | out: lpBuffer=0xcff698) [0077.151] GetCurrentThread () returned 0xfffffffe [0077.151] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0 | out: lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0) returned 1 [0077.151] GetCurrentProcess () returned 0xffffffff [0077.151] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0 | out: lpCreationTime=0xcff6d8, lpExitTime=0xcff6d0, lpKernelTime=0xcff6c8, lpUserTime=0xcff6c0) returned 1 [0077.151] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0xcff6f4, lpMaximumWorkingSetSize=0xcff6f0 | out: lpMinimumWorkingSetSize=0xcff6f4, lpMaximumWorkingSetSize=0xcff6f0) returned 1 [0077.151] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6b8 | out: lpPerformanceCount=0xcff6b8*=17216064957) returned 1 [0077.152] CryptGenRandom (in: hProv=0x106cfa0, dwLen=0x140, pbBuffer=0x291228 | out: pbBuffer=0x291228) returned 1 [0077.152] CryptAcquireContextW (in: phProv=0xcff354, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xcff354*=0x106d2d0) returned 1 [0077.153] CryptGenRandom (in: hProv=0x106d2d0, dwLen=0x80, pbBuffer=0xcff368 | out: pbBuffer=0xcff368) returned 1 [0077.153] CryptReleaseContext (hProv=0x106d2d0, dwFlags=0x0) returned 1 [0077.158] CryptAcquireContextW (in: phProv=0xcff354, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xcff354*=0x106d1c0) returned 1 [0077.158] CryptGenRandom (in: hProv=0x106d1c0, dwLen=0x80, pbBuffer=0xcff368 | out: pbBuffer=0xcff368) returned 1 [0077.158] CryptReleaseContext (hProv=0x106d1c0, dwFlags=0x0) returned 1 [0077.160] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1064678 [0077.160] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bc28 [0077.160] LocalAlloc (uFlags=0x40, uBytes=0x210) returned 0x106a4f0 [0077.161] ExpandEnvironmentStringsW (in: lpSrc="%windir%", lpDst=0x106a4f0, nSize=0x104 | out: lpDst="C:\\WINDOWS") returned 0xb [0077.161] _wcslwr (in: _String=0x106a4f0 | out: _String="c:\\windows") returned="c:\\windows" [0077.161] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106bc40 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106baf0 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x105eed0 [0077.161] lstrcpyW (in: lpString1=0x105eed0, lpString2=":\\$RECYCLE.BIN\\" | out: lpString1=":\\$RECYCLE.BIN\\") returned=":\\$RECYCLE.BIN\\" [0077.161] _wcslwr (in: _String=0x105eed0 | out: _String=":\\$recycle.bin\\") returned=":\\$recycle.bin\\" [0077.161] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b9d0 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106b9b8 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062200 [0077.161] lstrcpyW (in: lpString1=0x1062200, lpString2="\\windows\\system32\\" | out: lpString1="\\windows\\system32\\") returned="\\windows\\system32\\" [0077.161] _wcslwr (in: _String=0x1062200 | out: _String="\\windows\\system32\\") returned="\\windows\\system32\\" [0077.161] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106baa8 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106b9e8 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062170 [0077.161] lstrcpyW (in: lpString1=0x1062170, lpString2="\\windows\\syswow64\\" | out: lpString1="\\windows\\syswow64\\") returned="\\windows\\syswow64\\" [0077.161] _wcslwr (in: _String=0x1062170 | out: _String="\\windows\\syswow64\\") returned="\\windows\\syswow64\\" [0077.161] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106bb68 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bb08 [0077.161] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062320 [0077.161] lstrcpyW (in: lpString1=0x1062320, lpString2="\\windows\\system\\" | out: lpString1="\\windows\\system\\") returned="\\windows\\system\\" [0077.161] _wcslwr (in: _String=0x1062320 | out: _String="\\windows\\system\\") returned="\\windows\\system\\" [0077.161] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b958 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106b970 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061d38 [0077.162] lstrcpyW (in: lpString1=0x1061d38, lpString2="\\windows\\winsxs\\" | out: lpString1="\\windows\\winsxs\\") returned="\\windows\\winsxs\\" [0077.162] _wcslwr (in: _String=0x1061d38 | out: _String="\\windows\\winsxs\\") returned="\\windows\\winsxs\\" [0077.162] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ba18 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bb20 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x105ef40 [0077.162] lstrcpyW (in: lpString1=0x105ef40, lpString2="\\System\\msadc\\" | out: lpString1="\\System\\msadc\\") returned="\\System\\msadc\\" [0077.162] _wcslwr (in: _String=0x105ef40 | out: _String="\\system\\msadc\\") returned="\\system\\msadc\\" [0077.162] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b988 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bb38 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x105f138 [0077.162] lstrcpyW (in: lpString1=0x105f138, lpString2="\\Common Files\\" | out: lpString1="\\Common Files\\") returned="\\Common Files\\" [0077.162] _wcslwr (in: _String=0x105f138 | out: _String="\\common files\\") returned="\\common files\\" [0077.162] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ba48 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bac0 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061d80 [0077.162] lstrcpyW (in: lpString1=0x1061d80, lpString2="\\WindowsPowerShell\\" | out: lpString1="\\WindowsPowerShell\\") returned="\\WindowsPowerShell\\" [0077.162] _wcslwr (in: _String=0x1061d80 | out: _String="\\windowspowershell\\") returned="\\windowspowershell\\" [0077.162] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b8f8 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bad8 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x10612a8 [0077.162] lstrcpyW (in: lpString1=0x10612a8, lpString2="\\Program Files\\Internet Explorer\\" | out: lpString1="\\Program Files\\Internet Explorer\\") returned="\\Program Files\\Internet Explorer\\" [0077.162] _wcslwr (in: _String=0x10612a8 | out: _String="\\program files\\internet explorer\\") returned="\\program files\\internet explorer\\" [0077.162] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106bb98 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106bb50 [0077.162] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x105eb08 [0077.162] lstrcpyW (in: lpString1=0x105eb08, lpString2="\\Program Files\\Microsoft Games\\" | out: lpString1="\\Program Files\\Microsoft Games\\") returned="\\Program Files\\Microsoft Games\\" [0077.163] _wcslwr (in: _String=0x105eb08 | out: _String="\\program files\\microsoft games\\") returned="\\program files\\microsoft games\\" [0077.163] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b9a0 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ba90 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x10620e0 [0077.163] lstrcpyW (in: lpString1=0x10620e0, lpString2="\\all users\\microsoft\\" | out: lpString1="\\all users\\microsoft\\") returned="\\all users\\microsoft\\" [0077.163] _wcslwr (in: _String=0x10620e0 | out: _String="\\all users\\microsoft\\") returned="\\all users\\microsoft\\" [0077.163] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106bb80 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106b8c8 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dcb8 [0077.163] lstrcpyW (in: lpString1=0x106dcb8, lpString2="\\inetpub\\logs\\" | out: lpString1="\\inetpub\\logs\\") returned="\\inetpub\\logs\\" [0077.163] _wcslwr (in: _String=0x106dcb8 | out: _String="\\inetpub\\logs\\") returned="\\inetpub\\logs\\" [0077.163] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b928 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106b8b0 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x105aee8 [0077.163] lstrcpyW (in: lpString1=0x105aee8, lpString2=":\\boot\\" | out: lpString1=":\\boot\\") returned=":\\boot\\" [0077.163] _wcslwr (in: _String=0x105aee8 | out: _String=":\\boot\\") returned=":\\boot\\" [0077.163] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b8e0 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ba60 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e280 [0077.163] lstrcpyW (in: lpString1=0x106e280, lpString2=":\\system volume information\\" | out: lpString1=":\\system volume information\\") returned=":\\system volume information\\" [0077.163] _wcslwr (in: _String=0x106e280 | out: _String=":\\system volume information\\") returned=":\\system volume information\\" [0077.163] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b910 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ba00 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106db30 [0077.163] lstrcpyW (in: lpString1=0x106db30, lpString2=":\\drivers\\" | out: lpString1=":\\drivers\\") returned=":\\drivers\\" [0077.163] _wcslwr (in: _String=0x106db30 | out: _String=":\\drivers\\") returned=":\\drivers\\" [0077.163] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106b940 [0077.163] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ba30 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x105ace0 [0077.164] lstrcpyW (in: lpString1=0x105ace0, lpString2=":\\wsus\\" | out: lpString1=":\\wsus\\") returned=":\\wsus\\" [0077.164] _wcslwr (in: _String=0x105ace0 | out: _String=":\\wsus\\") returned=":\\wsus\\" [0077.164] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ba78 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e980 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x105af60 [0077.164] lstrcpyW (in: lpString1=0x105af60, lpString2="\\cache\\" | out: lpString1="\\cache\\") returned="\\cache\\" [0077.164] _wcslwr (in: _String=0x105af60 | out: _String="\\cache\\") returned="\\cache\\" [0077.164] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eb30 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e8f0 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106df58 [0077.164] lstrcpyW (in: lpString1=0x106df58, lpString2="\\cache2\\" | out: lpString1="\\cache2\\") returned="\\cache2\\" [0077.164] _wcslwr (in: _String=0x106df58 | out: _String="\\cache2\\") returned="\\cache2\\" [0077.164] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eba8 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ead0 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106de40 [0077.164] lstrcpyW (in: lpString1=0x106de40, lpString2="\\far manager\\" | out: lpString1="\\far manager\\") returned="\\far manager\\" [0077.164] _wcslwr (in: _String=0x106de40 | out: _String="\\far manager\\") returned="\\far manager\\" [0077.164] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eb00 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106eae8 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106daf8 [0077.164] lstrcpyW (in: lpString1=0x106daf8, lpString2="\\ida 7.0\\" | out: lpString1="\\ida 7.0\\") returned="\\ida 7.0\\" [0077.164] _wcslwr (in: _String=0x106daf8 | out: _String="\\ida 7.0\\") returned="\\ida 7.0\\" [0077.164] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106e9e0 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ebc0 [0077.164] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106d8c8 [0077.164] lstrcpyW (in: lpString1=0x106d8c8, lpString2="\\ida 6.8\\" | out: lpString1="\\ida 6.8\\") returned="\\ida 6.8\\" [0077.164] _wcslwr (in: _String=0x106d8c8 | out: _String="\\ida 6.8\\") returned="\\ida 6.8\\" [0077.164] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ea10 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106eb18 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061e10 [0077.165] lstrcpyW (in: lpString1=0x1061e10, lpString2="\\Default\\Extensions\\" | out: lpString1="\\Default\\Extensions\\") returned="\\Default\\Extensions\\" [0077.165] _wcslwr (in: _String=0x1061e10 | out: _String="\\default\\extensions\\") returned="\\default\\extensions\\" [0077.165] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eb48 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e950 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e330 [0077.165] lstrcpyW (in: lpString1=0x106e330, lpString2="\\Temporary Internet Files\\" | out: lpString1="\\Temporary Internet Files\\") returned="\\Temporary Internet Files\\" [0077.165] _wcslwr (in: _String=0x106e330 | out: _String="\\temporary internet files\\") returned="\\temporary internet files\\" [0077.165] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eab8 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ea58 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dd60 [0077.165] lstrcpyW (in: lpString1=0x106dd60, lpString2="\\Microsoft\\" | out: lpString1="\\Microsoft\\") returned="\\Microsoft\\" [0077.165] _wcslwr (in: _String=0x106dd60 | out: _String="\\microsoft\\") returned="\\microsoft\\" [0077.165] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106e938 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e998 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x105af88 [0077.165] lstrcpyW (in: lpString1=0x105af88, lpString2="\\Temp\\" | out: lpString1="\\Temp\\") returned="\\Temp\\" [0077.165] _wcslwr (in: _String=0x105af88 | out: _String="\\temp\\") returned="\\temp\\" [0077.165] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106e968 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e9f8 [0077.165] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106d9e0 [0077.165] lstrcpyW (in: lpString1=0x106d9e0, lpString2="$windows.~bt" | out: lpString1="$windows.~bt") returned="$windows.~bt" [0077.166] _wcslwr (in: _String=0x106d9e0 | out: _String="$windows.~bt") returned="$windows.~bt" [0077.166] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ea28 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e8d8 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106da18 [0077.166] lstrcpyW (in: lpString1=0x106da18, lpString2="$windows.~ws" | out: lpString1="$windows.~ws") returned="$windows.~ws" [0077.166] _wcslwr (in: _String=0x106da18 | out: _String="$windows.~ws") returned="$windows.~ws" [0077.166] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ea40 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e908 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106da50 [0077.166] lstrcpyW (in: lpString1=0x106da50, lpString2="\\google\\" | out: lpString1="\\google\\") returned="\\google\\" [0077.166] _wcslwr (in: _String=0x106da50 | out: _String="\\google\\") returned="\\google\\" [0077.166] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eb78 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e920 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106df90 [0077.166] lstrcpyW (in: lpString1=0x106df90, lpString2="\\mozilla\\" | out: lpString1="\\mozilla\\") returned="\\mozilla\\" [0077.166] _wcslwr (in: _String=0x106df90 | out: _String="\\mozilla\\") returned="\\mozilla\\" [0077.166] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106e9b0 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ea70 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106de78 [0077.166] lstrcpyW (in: lpString1=0x106de78, lpString2="\\tor browser\\" | out: lpString1="\\tor browser\\") returned="\\tor browser\\" [0077.166] _wcslwr (in: _String=0x106de78 | out: _String="\\tor browser\\") returned="\\tor browser\\" [0077.166] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eb60 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106e9c8 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dc10 [0077.166] lstrcpyW (in: lpString1=0x106dc10, lpString2="\\windows.old\\" | out: lpString1="\\windows.old\\") returned="\\windows.old\\" [0077.166] _wcslwr (in: _String=0x106dc10 | out: _String="\\windows.old\\") returned="\\windows.old\\" [0077.166] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ea88 [0077.166] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106eaa0 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x105afb0 [0077.167] lstrcpyW (in: lpString1=0x105afb0, lpString2="\\intel\\" | out: lpString1="\\intel\\") returned="\\intel\\" [0077.167] _wcslwr (in: _String=0x105afb0 | out: _String="\\intel\\") returned="\\intel\\" [0077.167] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106eb90 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ec68 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106d900 [0077.167] lstrcpyW (in: lpString1=0x106d900, lpString2="\\msocache\\" | out: lpString1="\\msocache\\") returned="\\msocache\\" [0077.167] _wcslwr (in: _String=0x106d900 | out: _String="\\msocache\\") returned="\\msocache\\" [0077.167] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ec80 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ec50 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106db68 [0077.167] lstrcpyW (in: lpString1=0x106db68, lpString2="\\perflogs\\" | out: lpString1="\\perflogs\\") returned="\\perflogs\\" [0077.167] _wcslwr (in: _String=0x106db68 | out: _String="\\perflogs\\") returned="\\perflogs\\" [0077.167] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ec98 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x10622d8 [0077.167] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1067930 [0077.167] CryptAcquireContextW (in: phProv=0x291208, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x291208*=0x106d028) returned 1 [0077.168] StrStrIW (lpFirst="\"C:\\Users\\FD1HVy\\Desktop\\ransomware.exe\" ", lpSrch="--kill-susp") returned 0x0 [0077.169] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0077.170] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ec38 [0077.170] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x106ec38 | out: lpBuffer="C:\\") returned 0x4 [0077.170] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.170] LocalAlloc (uFlags=0x40, uBytes=0x5a0) returned 0x106efb0 [0077.170] StrDupW (lpSrch="C:\\") returned="C:\\" [0077.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x27f930, lpParameter=0x106efb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0077.171] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ebd8 [0077.171] GetLastError () returned 0x0 [0077.171] lstrlenA (lpString="DRIVE_FIXED : %ws\n") returned 18 [0077.171] LocalAlloc (uFlags=0x40, uBytes=0x213) returned 0x106f558 [0077.171] wvnsprintfA (in: pszDest=0x106f558, cchDest=530, pszFmt="DRIVE_FIXED : %ws\n", arglist=0xcff730 | out: pszDest="DRIVE_FIXED : C:\\\n") returned 18 [0077.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x170 [0077.171] WriteFile (in: hFile=0x170, lpBuffer=0x106f558*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0xcff704, lpOverlapped=0x0 | out: lpBuffer=0x106f558*, lpNumberOfBytesWritten=0xcff704*=0x12, lpOverlapped=0x0) returned 1 [0077.259] OutputDebugStringA (lpOutputString="DRIVE_FIXED : C:\\\n") [0077.279] FlushFileBuffers (hFile=0x170) returned 0 [0077.372] LocalFree (hMem=0x106f558) returned 0x0 [0077.372] SetLastError (dwErrCode=0x0) [0077.372] StrStrIW (lpFirst="\"C:\\Users\\FD1HVy\\Desktop\\ransomware.exe\" ", lpSrch="--enable-shares") returned 0x0 [0077.373] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x11f0 Thread: id = 8 os_tid = 0x10a0 [0077.188] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x105e690 [0077.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x283cf0, lpParameter=0x105e690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac [0077.189] GetTickCount () returned 0x115490b [0077.189] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ec08 [0077.189] LocalAlloc (uFlags=0x40, uBytes=0xfb0) returned 0x1070058 [0077.190] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1064648 [0077.190] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ec20 [0077.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x27f740, lpParameter=0x106efb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0077.191] CloseHandle (hObject=0x1b0) returned 1 [0077.191] StrCpyNW (in: psz1=0x106f114, psz2="C:\\", cchMax=252 | out: psz1="C:\\") returned="C:\\" [0077.191] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.191] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.191] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.191] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.191] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.191] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.191] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.191] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.191] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.191] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.191] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.191] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.191] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.192] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.192] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.192] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.192] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.192] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.193] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.193] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.193] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.193] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.193] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.193] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.193] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.194] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.194] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.194] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.194] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.194] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.194] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.194] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.195] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.195] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.195] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.195] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.195] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.195] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.195] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.195] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.196] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.196] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.196] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.196] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.197] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.197] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.197] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.197] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.197] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.197] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.198] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.198] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.198] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.198] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.198] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.198] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.198] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.198] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.199] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.199] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.199] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.199] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.199] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.199] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.199] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.199] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.200] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.200] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.200] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.200] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.200] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.200] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.200] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.200] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.200] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.201] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.201] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.201] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.201] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.201] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.201] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.201] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.201] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.201] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.201] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.201] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.202] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.202] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.202] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.202] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.202] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.202] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.202] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.203] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.203] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.203] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.203] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.203] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.203] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.204] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.204] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.205] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.205] LocalAlloc (uFlags=0x40, uBytes=0x8010) returned 0x1072830 [0077.206] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106deb0 [0077.206] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x105add0 [0077.206] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x105f888 [0077.206] lstrcpyW (in: lpString1=0x105add0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.206] lstrcpyW (in: lpString1=0x105f888, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.206] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.206] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.206] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071388 [0077.206] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061c18 [0077.206] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10714c0 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dac0 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107a940 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x105f6b8 [0077.207] lstrcpyW (in: lpString1=0x107a940, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.207] lstrcpyW (in: lpString1=0x105f6b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.207] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.207] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.207] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10713a0 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062248 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071490 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106ddd0 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107a8f0 [0077.207] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x1060e10 [0077.207] lstrcpyW (in: lpString1=0x107a8f0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.207] lstrcpyW (in: lpString1=0x1060e10, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.207] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.208] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.208] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071610 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e800 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10713d0 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dc48 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107ab98 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x1061160 [0077.208] lstrcpyW (in: lpString1=0x107ab98, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.208] lstrcpyW (in: lpString1=0x1061160, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.208] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.208] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.208] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10715f8 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106da88 [0077.208] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071628 [0077.209] PathFindFileNameW (pszPath="bootmgr") returned="bootmgr" [0077.209] _wcslwr (in: _String=0x2d3f3c4 | out: _String="bootmgr") returned="bootmgr" [0077.209] PathFindFileNameW (pszPath="BOOTSECT.BAK") returned="BOOTSECT.BAK" [0077.209] _wcslwr (in: _String=0x2d3f3c4 | out: _String="bootsect.bak") returned="bootsect.bak" [0077.209] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dc80 [0077.209] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107ac60 [0077.209] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x1060f40 [0077.209] lstrcpyW (in: lpString1=0x107ac60, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.209] lstrcpyW (in: lpString1=0x1060f40, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.209] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.209] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071418 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e6f8 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10713b8 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dee8 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107abe8 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x105fca0 [0077.210] lstrcpyW (in: lpString1=0x107abe8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.210] lstrcpyW (in: lpString1=0x105fca0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.210] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.210] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071430 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106df20 [0077.210] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10714d8 [0077.210] PathFindFileNameW (pszPath="hiberfil.sys") returned="hiberfil.sys" [0077.210] _wcslwr (in: _String=0x2d3f3c4 | out: _String="hiberfil.sys") returned="hiberfil.sys" [0077.210] PathFindExtensionW (pszPath="hiberfil.sys") returned=".sys" [0077.210] LocalAlloc (uFlags=0x40, uBytes=0x410) returned 0x107b450 [0077.210] lstrcatW (in: lpString1="", lpString2="sys" | out: lpString1="sys") returned="sys" [0077.210] _wcslwr (in: _String=0x107b450 | out: _String="sys") returned="sys" [0077.211] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dba0 [0077.211] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107aa08 [0077.211] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x106a708 [0077.211] lstrcpyW (in: lpString1=0x107aa08, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.211] lstrcpyW (in: lpString1=0x106a708, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.211] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.211] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.211] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071550 [0077.211] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dcf0 [0077.211] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10714f0 [0077.211] PathFindFileNameW (pszPath="pagefile.sys") returned="pagefile.sys" [0077.211] _wcslwr (in: _String=0x2d3f3c4 | out: _String="pagefile.sys") returned="pagefile.sys" [0077.211] PathFindExtensionW (pszPath="pagefile.sys") returned=".sys" [0077.211] lstrcatW (in: lpString1="", lpString2="sys" | out: lpString1="sys") returned="sys" [0077.211] _wcslwr (in: _String=0x107b450 | out: _String="sys") returned="sys" [0077.212] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dd28 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107ad28 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x106a7d0 [0077.212] lstrcpyW (in: lpString1=0x107ad28, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.212] lstrcpyW (in: lpString1=0x106a7d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.212] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.212] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.212] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071358 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dd98 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071448 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106de08 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107a918 [0077.212] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107b868 [0077.212] lstrcpyW (in: lpString1=0x107a918, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.212] lstrcpyW (in: lpString1=0x107b868, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.212] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.212] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071508 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061e58 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071400 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106d938 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107a968 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107b930 [0077.213] lstrcpyW (in: lpString1=0x107a968, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.213] lstrcpyW (in: lpString1=0x107b930, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.213] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.213] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071460 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e388 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071520 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106d970 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107aa30 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107b9f8 [0077.213] lstrcpyW (in: lpString1=0x107aa30, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.213] lstrcpyW (in: lpString1=0x107b9f8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.213] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.213] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071478 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061f30 [0077.213] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071538 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106d9a8 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107a9b8 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107bac0 [0077.214] lstrcpyW (in: lpString1=0x107a9b8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.214] lstrcpyW (in: lpString1=0x107bac0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.214] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.214] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10714a8 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106e038 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10715c8 [0077.214] PathFindFileNameW (pszPath="swapfile.sys") returned="swapfile.sys" [0077.214] _wcslwr (in: _String=0x2d3f3c4 | out: _String="swapfile.sys") returned="swapfile.sys" [0077.214] PathFindExtensionW (pszPath="swapfile.sys") returned=".sys" [0077.214] lstrcatW (in: lpString1="", lpString2="sys" | out: lpString1="sys") returned="sys" [0077.214] _wcslwr (in: _String=0x107b450 | out: _String="sys") returned="sys" [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106e000 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107ab70 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107bb88 [0077.214] lstrcpyW (in: lpString1=0x107ab70, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.214] lstrcpyW (in: lpString1=0x107bb88, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.214] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.214] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071568 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e228 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071580 [0077.214] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dfc8 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107ac38 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107bc50 [0077.215] lstrcpyW (in: lpString1=0x107ac38, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.215] lstrcpyW (in: lpString1=0x107bc50, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.215] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.215] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071598 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c3a0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071370 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c1e0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107a8a0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107c520 [0077.215] lstrcpyW (in: lpString1=0x107a8a0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.215] lstrcpyW (in: lpString1=0x107c520, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.215] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.215] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10715b0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c368 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10715e0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c2c0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x107abc0 [0077.215] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x107c5e8 [0077.215] lstrcpyW (in: lpString1=0x107abc0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0077.215] lstrcpyW (in: lpString1=0x107c5e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.215] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0077.215] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0077.216] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071340 [0077.233] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x10621b8 [0077.233] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10717d8 [0077.233] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.233] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.233] LocalFree (hMem=0x1071818) returned 0x0 [0077.233] NtClose (Handle=0x1b0) returned 0x0 [0077.234] GetProcessHeap () returned 0x1050000 [0077.234] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x10713e8 | out: hHeap=0x1050000) returned 1 [0077.234] LocalFree (hMem=0x106ec08) returned 0x0 [0077.234] LocalFree (hMem=0x106ec20) returned 0x0 [0077.234] StrCpyNW (in: psz1=0x106f114, psz2="C:\\$GetCurrent\\", cchMax=252 | out: psz1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0077.234] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.234] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.234] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.234] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.234] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.234] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.234] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.234] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.234] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.235] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.235] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.235] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.235] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.235] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.235] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.235] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.235] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.235] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.235] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.235] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.235] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.236] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.236] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.236] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.236] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.236] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.236] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.237] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.237] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.237] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.238] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.238] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.238] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.238] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.238] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.238] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.239] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.239] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.239] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.239] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.239] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.239] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.240] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.240] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.240] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.241] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.241] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.241] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.241] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.242] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.242] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.242] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.242] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.242] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.244] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.244] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.244] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.244] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.244] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.245] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.245] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.245] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.246] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.246] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.246] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.247] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.247] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.248] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.248] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.249] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.249] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.249] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.249] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.249] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.250] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.250] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.250] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.250] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.250] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.251] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.251] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.251] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.251] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.251] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.252] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.252] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.253] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.253] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.253] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.253] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.254] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.254] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.254] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.254] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.255] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.255] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.256] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.257] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.257] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.257] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\$GetCurrent\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\$GetCurrent\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.257] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\$GetCurrent\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.260] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.260] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.260] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.260] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c410 [0077.260] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061ea0 [0077.260] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x107dae0 [0077.261] lstrcpyW (in: lpString1=0x1061ea0, lpString2="C:\\$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0077.261] lstrcpyW (in: lpString1=0x107dae0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.261] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\$GetCurrent\\" | out: lpString1="\\\\?\\C:\\$GetCurrent\\") returned="\\\\?\\C:\\$GetCurrent\\" [0077.261] lstrcatW (in: lpString1="\\\\?\\C:\\$GetCurrent\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\$GetCurrent\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\$GetCurrent\\!!_FILES_ENCRYPTED_.txt" [0077.261] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10713e8 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061fc0 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071718 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c2f8 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062290 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x107dbc8 [0077.261] lstrcpyW (in: lpString1=0x1062290, lpString2="C:\\$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0077.261] lstrcpyW (in: lpString1=0x107dbc8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.261] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\$GetCurrent\\" | out: lpString1="\\\\?\\C:\\$GetCurrent\\") returned="\\\\?\\C:\\$GetCurrent\\" [0077.261] lstrcatW (in: lpString1="\\\\?\\C:\\$GetCurrent\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\$GetCurrent\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\$GetCurrent\\!!_FILES_ENCRYPTED_.txt" [0077.261] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10716b8 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e6a0 [0077.261] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071748 [0077.261] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.262] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.262] LocalFree (hMem=0x1071818) returned 0x0 [0077.262] NtClose (Handle=0x1b0) returned 0x0 [0077.262] GetProcessHeap () returned 0x1050000 [0077.262] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x1064708 | out: hHeap=0x1050000) returned 1 [0077.262] LocalFree (hMem=0x1061c18) returned 0x0 [0077.262] LocalFree (hMem=0x1071388) returned 0x0 [0077.262] LocalFree (hMem=0x10714c0) returned 0x0 [0077.262] StrCpyNW (in: psz1=0x106f114, psz2="C:\\$Recycle.Bin\\", cchMax=252 | out: psz1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0077.262] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.262] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.262] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.262] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.262] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.262] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.262] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.262] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.265] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.265] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.265] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.265] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.265] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.265] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.266] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.266] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.266] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.266] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.266] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.266] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.266] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.266] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.266] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.266] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.266] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.266] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.266] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.266] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.267] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.267] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.267] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.267] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.267] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.267] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.267] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0077.267] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0077.267] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.267] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.267] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.267] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.267] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.267] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.267] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.267] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.267] LocalFree (hMem=0x1062248) returned 0x0 [0077.267] LocalFree (hMem=0x10713a0) returned 0x0 [0077.267] LocalFree (hMem=0x1071490) returned 0x0 [0077.267] StrCpyNW (in: psz1=0x106f114, psz2="C:\\588bce7c90097ed212\\", cchMax=252 | out: psz1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.267] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.267] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.267] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.267] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.267] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.267] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.267] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.267] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.267] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.267] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.267] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.268] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.268] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.268] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.268] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.268] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.268] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.269] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.269] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.269] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.269] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.269] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.269] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.269] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.269] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.269] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.269] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.269] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.269] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.269] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.270] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.270] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.271] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.271] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.271] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.271] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.271] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.271] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.271] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.271] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.271] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.272] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.272] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.272] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.273] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.273] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.273] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.274] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.274] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.274] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.274] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.274] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.275] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.275] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.275] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.276] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.276] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.276] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.277] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.277] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.277] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.277] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.278] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.278] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.281] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.281] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.281] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.282] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.282] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.282] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.283] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.283] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.283] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.284] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.284] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.284] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.285] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.285] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.285] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.285] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.285] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.287] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.287] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.287] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.287] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.287] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.288] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.288] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.288] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\588bce7c90097ed212\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.290] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.290] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.291] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.293] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c218 [0077.293] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e2d8 [0077.293] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107dcb0 [0077.293] lstrcpyW (in: lpString1=0x106e2d8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.293] lstrcpyW (in: lpString1=0x107dcb0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.293] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.293] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.293] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071388 [0077.293] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e648 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10713a0 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c3d8 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e3e0 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107dda8 [0077.294] lstrcpyW (in: lpString1=0x106e3e0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.294] lstrcpyW (in: lpString1=0x107dda8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.294] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.294] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.294] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071490 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e178 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10714c0 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bfb0 [0077.294] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e750 [0077.295] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107dea0 [0077.295] lstrcpyW (in: lpString1=0x106e750, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.295] lstrcpyW (in: lpString1=0x107dea0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.295] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.295] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.295] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10717c0 [0077.295] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e4e8 [0077.295] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10716d0 [0077.295] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c250 [0077.295] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e1d0 [0077.295] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107df98 [0077.295] lstrcpyW (in: lpString1=0x106e1d0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.295] lstrcpyW (in: lpString1=0x107df98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.296] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.296] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10717f0 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e7a8 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071700 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bd80 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e438 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107e090 [0077.296] lstrcpyW (in: lpString1=0x106e438, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.296] lstrcpyW (in: lpString1=0x107e090, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.296] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.296] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071790 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e490 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071760 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bf40 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e540 [0077.296] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107e188 [0077.296] lstrcpyW (in: lpString1=0x106e540, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.296] lstrcpyW (in: lpString1=0x107e188, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.297] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.297] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10717a8 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e598 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071658 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c288 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e5f0 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107e280 [0077.297] lstrcpyW (in: lpString1=0x106e5f0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.297] lstrcpyW (in: lpString1=0x107e280, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.297] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.297] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10716e8 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e0c8 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071640 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bd48 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e120 [0077.297] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107e378 [0077.297] lstrcpyW (in: lpString1=0x106e120, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.297] lstrcpyW (in: lpString1=0x107e378, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.298] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.298] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.298] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071670 [0077.298] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f208 [0077.298] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071730 [0077.298] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c330 [0077.298] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107eff8 [0077.298] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107f478 [0077.298] lstrcpyW (in: lpString1=0x107eff8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.298] lstrcpyW (in: lpString1=0x107f478, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.298] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.298] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.298] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071778 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f310 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10712b0 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bdb8 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f2b8 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107f570 [0077.299] lstrcpyW (in: lpString1=0x107f2b8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.299] lstrcpyW (in: lpString1=0x107f570, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.299] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.299] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10710b8 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f100 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071220 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c0c8 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f368 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107f668 [0077.299] lstrcpyW (in: lpString1=0x107f368, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.299] lstrcpyW (in: lpString1=0x107f668, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.299] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.299] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10710a0 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f0a8 [0077.299] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071190 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107be28 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f158 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107f760 [0077.300] lstrcpyW (in: lpString1=0x107f158, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.300] lstrcpyW (in: lpString1=0x107f760, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.300] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.300] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10710d0 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f1b0 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071040 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107be98 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f260 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107f858 [0077.300] lstrcpyW (in: lpString1=0x107f260, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.300] lstrcpyW (in: lpString1=0x107f858, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.300] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.300] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071328 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f050 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10712e0 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bdf0 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f418 [0077.300] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107f950 [0077.300] lstrcpyW (in: lpString1=0x107f418, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.300] lstrcpyW (in: lpString1=0x107f950, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.301] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.301] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071118 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107f3c0 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10712c8 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c1a8 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107efa0 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107fa48 [0077.301] lstrcpyW (in: lpString1=0x107efa0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.301] lstrcpyW (in: lpString1=0x107fa48, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.301] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.301] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10711a8 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e550 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071088 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c020 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e4a0 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107fb40 [0077.301] lstrcpyW (in: lpString1=0x107e4a0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.301] lstrcpyW (in: lpString1=0x107fb40, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.301] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.301] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071250 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ef48 [0077.301] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071238 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c170 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e810 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107fc38 [0077.302] lstrcpyW (in: lpString1=0x107e810, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.302] lstrcpyW (in: lpString1=0x107fc38, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.302] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.302] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10712f8 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107eef0 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071100 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bfe8 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ec30 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080708 [0077.302] lstrcpyW (in: lpString1=0x107ec30, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.302] lstrcpyW (in: lpString1=0x1080708, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.302] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.302] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071310 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107eb28 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071178 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c058 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ece0 [0077.302] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080328 [0077.302] lstrcpyW (in: lpString1=0x107ece0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.302] lstrcpyW (in: lpString1=0x1080328, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.303] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.303] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10711c0 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ed38 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071058 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c100 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ed90 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080800 [0077.303] lstrcpyW (in: lpString1=0x107ed90, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.303] lstrcpyW (in: lpString1=0x1080800, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.303] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.303] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071130 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ec88 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071070 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c090 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e970 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10809f0 [0077.303] lstrcpyW (in: lpString1=0x107e970, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.303] lstrcpyW (in: lpString1=0x10809f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.303] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.303] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071148 [0077.303] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e8c0 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10711d8 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c138 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e918 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080610 [0077.304] lstrcpyW (in: lpString1=0x107e918, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.304] lstrcpyW (in: lpString1=0x1080610, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.304] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.304] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071160 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e5a8 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10710e8 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107be60 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e760 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080230 [0077.304] lstrcpyW (in: lpString1=0x107e760, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.304] lstrcpyW (in: lpString1=0x1080230, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.304] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.304] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071298 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107eb80 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10711f0 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bed0 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ede8 [0077.304] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10808f8 [0077.304] lstrcpyW (in: lpString1=0x107ede8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.304] lstrcpyW (in: lpString1=0x10808f8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.305] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.305] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071208 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e9c8 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071268 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bf08 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e4f8 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080420 [0077.305] lstrcpyW (in: lpString1=0x107e4f8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.305] lstrcpyW (in: lpString1=0x1080420, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.305] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.305] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071280 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e600 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x106ec08 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107bf78 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ee40 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080ae8 [0077.305] lstrcpyW (in: lpString1=0x107ee40, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.305] lstrcpyW (in: lpString1=0x1080ae8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.305] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.305] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x106ec20 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ebd8 [0077.305] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081440 [0077.306] PathFindFileNameW (pszPath="DHtmlHeader.html") returned="DHtmlHeader.html" [0077.306] _wcslwr (in: _String=0x2d3f3c4 | out: _String="dhtmlheader.html") returned="dhtmlheader.html" [0077.306] PathFindExtensionW (pszPath="DHtmlHeader.html") returned=".html" [0077.306] lstrcatW (in: lpString1="", lpString2="html" | out: lpString1="html") returned="html" [0077.306] _wcslwr (in: _String=0x107b450 | out: _String="html") returned="html" [0077.306] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c448 [0077.306] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e658 [0077.306] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x105f518 [0077.306] lstrcpyW (in: lpString1=0x107e658, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.306] lstrcpyW (in: lpString1=0x105f518, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.306] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.306] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="DHtmlHeader.html" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" [0077.306] PathFindFileNameW (pszPath="DisplayIcon.ico") returned="DisplayIcon.ico" [0077.306] _wcslwr (in: _String=0x2d3f3c4 | out: _String="displayicon.ico") returned="displayicon.ico" [0077.306] PathFindExtensionW (pszPath="DisplayIcon.ico") returned=".ico" [0077.306] lstrcatW (in: lpString1="", lpString2="ico" | out: lpString1="ico") returned="ico" [0077.306] _wcslwr (in: _String=0x107b450 | out: _String="ico") returned="ico" [0077.306] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c480 [0077.306] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ea20 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080be0 [0077.307] lstrcpyW (in: lpString1=0x107ea20, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.307] lstrcpyW (in: lpString1=0x1080be0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.307] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.307] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081398 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x106b808 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10813e0 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x107c4b8 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e6b0 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107ff48 [0077.307] lstrcpyW (in: lpString1=0x107e6b0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.307] lstrcpyW (in: lpString1=0x107ff48, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.307] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.307] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\588bce7c90097ed212\\!!_FILES_ENCRYPTED_.txt" [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081458 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x10610a0 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081380 [0077.307] PathFindFileNameW (pszPath="header.bmp") returned="header.bmp" [0077.307] _wcslwr (in: _String=0x2d3f3c4 | out: _String="header.bmp") returned="header.bmp" [0077.307] PathFindExtensionW (pszPath="header.bmp") returned=".bmp" [0077.307] lstrcatW (in: lpString1="", lpString2="bmp" | out: lpString1="bmp") returned="bmp" [0077.307] _wcslwr (in: _String=0x107b450 | out: _String="bmp") returned="bmp" [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081b90 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ee98 [0077.307] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106d248 [0077.308] lstrcpyW (in: lpString1=0x107ee98, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.308] lstrcpyW (in: lpString1=0x106d248, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.308] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.308] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="header.bmp" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\header.bmp") returned="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" [0077.308] PathFindFileNameW (pszPath="netfx_Core.mzz") returned="netfx_Core.mzz" [0077.308] _wcslwr (in: _String=0x2d3f3c4 | out: _String="netfx_core.mzz") returned="netfx_core.mzz" [0077.308] PathFindExtensionW (pszPath="netfx_Core.mzz") returned=".mzz" [0077.308] lstrcatW (in: lpString1="", lpString2="mzz" | out: lpString1="mzz") returned="mzz" [0077.308] _wcslwr (in: _String=0x107b450 | out: _String="mzz") returned="mzz" [0077.308] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081618 [0077.308] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e708 [0077.308] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x105e4b0 [0077.308] lstrcpyW (in: lpString1=0x107e708, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.308] lstrcpyW (in: lpString1=0x105e4b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.308] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.308] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="netfx_Core.mzz" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" [0077.308] PathFindFileNameW (pszPath="netfx_Core_x64.msi") returned="netfx_Core_x64.msi" [0077.308] _wcslwr (in: _String=0x2d3f3c4 | out: _String="netfx_core_x64.msi") returned="netfx_core_x64.msi" [0077.308] PathFindExtensionW (pszPath="netfx_Core_x64.msi") returned=".msi" [0077.308] lstrcatW (in: lpString1="", lpString2="msi" | out: lpString1="msi") returned="msi" [0077.308] _wcslwr (in: _String=0x107b450 | out: _String="msi") returned="msi" [0077.308] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10818f0 [0077.308] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e7b8 [0077.309] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x105e3e8 [0077.309] lstrcpyW (in: lpString1=0x107e7b8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.309] lstrcpyW (in: lpString1=0x105e3e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.309] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.309] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x64.msi" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" [0077.309] PathFindFileNameW (pszPath="netfx_Core_x86.msi") returned="netfx_Core_x86.msi" [0077.309] _wcslwr (in: _String=0x2d3f3c4 | out: _String="netfx_core_x86.msi") returned="netfx_core_x86.msi" [0077.309] PathFindExtensionW (pszPath="netfx_Core_x86.msi") returned=".msi" [0077.309] lstrcatW (in: lpString1="", lpString2="msi" | out: lpString1="msi") returned="msi" [0077.309] _wcslwr (in: _String=0x107b450 | out: _String="msi") returned="msi" [0077.309] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081688 [0077.309] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107e868 [0077.309] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1081d48 [0077.309] lstrcpyW (in: lpString1=0x107e868, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.309] lstrcpyW (in: lpString1=0x1081d48, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.309] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.309] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="netfx_Core_x86.msi" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" [0077.309] PathFindFileNameW (pszPath="netfx_Extended.mzz") returned="netfx_Extended.mzz" [0077.309] _wcslwr (in: _String=0x2d3f3c4 | out: _String="netfx_extended.mzz") returned="netfx_extended.mzz" [0077.309] PathFindExtensionW (pszPath="netfx_Extended.mzz") returned=".mzz" [0077.310] lstrcatW (in: lpString1="", lpString2="mzz" | out: lpString1="mzz") returned="mzz" [0077.310] _wcslwr (in: _String=0x107b450 | out: _String="mzz") returned="mzz" [0077.310] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10816c0 [0077.310] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ea78 [0077.310] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1081df0 [0077.310] lstrcpyW (in: lpString1=0x107ea78, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.310] lstrcpyW (in: lpString1=0x1081df0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.310] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.310] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="netfx_Extended.mzz" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" [0077.310] PathFindFileNameW (pszPath="netfx_Extended_x64.msi") returned="netfx_Extended_x64.msi" [0077.310] _wcslwr (in: _String=0x2d3f3c4 | out: _String="netfx_extended_x64.msi") returned="netfx_extended_x64.msi" [0077.310] PathFindExtensionW (pszPath="netfx_Extended_x64.msi") returned=".msi" [0077.310] lstrcatW (in: lpString1="", lpString2="msi" | out: lpString1="msi") returned="msi" [0077.310] _wcslwr (in: _String=0x107b450 | out: _String="msi") returned="msi" [0077.310] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081b58 [0077.310] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x107ead0 [0077.310] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x1081e98 [0077.310] lstrcpyW (in: lpString1=0x107ead0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.310] lstrcpyW (in: lpString1=0x1081e98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.310] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.310] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x64.msi" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" [0077.310] PathFindFileNameW (pszPath="netfx_Extended_x86.msi") returned="netfx_Extended_x86.msi" [0077.311] _wcslwr (in: _String=0x2d3f3c4 | out: _String="netfx_extended_x86.msi") returned="netfx_extended_x86.msi" [0077.311] PathFindExtensionW (pszPath="netfx_Extended_x86.msi") returned=".msi" [0077.311] lstrcatW (in: lpString1="", lpString2="msi" | out: lpString1="msi") returned="msi" [0077.311] _wcslwr (in: _String=0x107b450 | out: _String="msi") returned="msi" [0077.311] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081a78 [0077.311] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082df0 [0077.311] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x1082f58 [0077.311] lstrcpyW (in: lpString1=0x1082df0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.311] lstrcpyW (in: lpString1=0x1082f58, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.311] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.311] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="netfx_Extended_x86.msi" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" [0077.311] PathFindFileNameW (pszPath="ParameterInfo.xml") returned="ParameterInfo.xml" [0077.311] _wcslwr (in: _String=0x2d3f3c4 | out: _String="parameterinfo.xml") returned="parameterinfo.xml" [0077.311] PathFindExtensionW (pszPath="ParameterInfo.xml") returned=".xml" [0077.311] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0077.311] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0077.311] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10816f8 [0077.311] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082c90 [0077.311] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1083010 [0077.311] lstrcpyW (in: lpString1=0x1082c90, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.311] lstrcpyW (in: lpString1=0x1083010, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.312] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.312] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="ParameterInfo.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" [0077.312] PathFindFileNameW (pszPath="RGB9RAST_x64.msi") returned="RGB9RAST_x64.msi" [0077.312] _wcslwr (in: _String=0x2d3f3c4 | out: _String="rgb9rast_x64.msi") returned="rgb9rast_x64.msi" [0077.312] PathFindExtensionW (pszPath="RGB9RAST_x64.msi") returned=".msi" [0077.312] lstrcatW (in: lpString1="", lpString2="msi" | out: lpString1="msi") returned="msi" [0077.312] _wcslwr (in: _String=0x107b450 | out: _String="msi") returned="msi" [0077.312] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10819d0 [0077.312] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082ef8 [0077.312] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x10830b8 [0077.312] lstrcpyW (in: lpString1=0x1082ef8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.312] lstrcpyW (in: lpString1=0x10830b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.312] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.312] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="RGB9RAST_x64.msi" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" [0077.312] PathFindFileNameW (pszPath="RGB9Rast_x86.msi") returned="RGB9Rast_x86.msi" [0077.312] _wcslwr (in: _String=0x2d3f3c4 | out: _String="rgb9rast_x86.msi") returned="rgb9rast_x86.msi" [0077.312] PathFindExtensionW (pszPath="RGB9Rast_x86.msi") returned=".msi" [0077.312] lstrcatW (in: lpString1="", lpString2="msi" | out: lpString1="msi") returned="msi" [0077.312] _wcslwr (in: _String=0x107b450 | out: _String="msi") returned="msi" [0077.312] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081730 [0077.312] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082a80 [0077.312] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x1083150 [0077.312] lstrcpyW (in: lpString1=0x1082a80, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.313] lstrcpyW (in: lpString1=0x1083150, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.313] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.313] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="RGB9Rast_x86.msi" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" [0077.313] PathFindFileNameW (pszPath="Setup.exe") returned="Setup.exe" [0077.313] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setup.exe") returned="setup.exe" [0077.313] PathFindExtensionW (pszPath="Setup.exe") returned=".exe" [0077.313] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0077.313] _wcslwr (in: _String=0x107b450 | out: _String="exe") returned="exe" [0077.313] PathFindFileNameW (pszPath="SetupEngine.dll") returned="SetupEngine.dll" [0077.313] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupengine.dll") returned="setupengine.dll" [0077.313] PathFindExtensionW (pszPath="SetupEngine.dll") returned=".dll" [0077.313] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0077.313] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0077.313] PathFindFileNameW (pszPath="SetupUi.dll") returned="SetupUi.dll" [0077.313] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupui.dll") returned="setupui.dll" [0077.313] PathFindExtensionW (pszPath="SetupUi.dll") returned=".dll" [0077.313] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0077.313] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0077.313] PathFindFileNameW (pszPath="SetupUi.xsd") returned="SetupUi.xsd" [0077.313] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupui.xsd") returned="setupui.xsd" [0077.313] PathFindExtensionW (pszPath="SetupUi.xsd") returned=".xsd" [0077.314] lstrcatW (in: lpString1="", lpString2="xsd" | out: lpString1="xsd") returned="xsd" [0077.314] _wcslwr (in: _String=0x107b450 | out: _String="xsd") returned="xsd" [0077.314] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081928 [0077.314] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082ea0 [0077.314] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106cd80 [0077.314] lstrcpyW (in: lpString1=0x1082ea0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.314] lstrcpyW (in: lpString1=0x106cd80, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.314] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.314] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="SetupUi.xsd" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd") returned="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" [0077.314] PathFindFileNameW (pszPath="SetupUtility.exe") returned="SetupUtility.exe" [0077.314] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setuputility.exe") returned="setuputility.exe" [0077.314] PathFindExtensionW (pszPath="SetupUtility.exe") returned=".exe" [0077.314] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0077.314] _wcslwr (in: _String=0x107b450 | out: _String="exe") returned="exe" [0077.314] PathFindFileNameW (pszPath="SplashScreen.bmp") returned="SplashScreen.bmp" [0077.314] _wcslwr (in: _String=0x2d3f3c4 | out: _String="splashscreen.bmp") returned="splashscreen.bmp" [0077.314] PathFindExtensionW (pszPath="SplashScreen.bmp") returned=".bmp" [0077.314] lstrcatW (in: lpString1="", lpString2="bmp" | out: lpString1="bmp") returned="bmp" [0077.314] _wcslwr (in: _String=0x107b450 | out: _String="bmp") returned="bmp" [0077.314] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081bc8 [0077.314] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082b88 [0077.314] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x10831e8 [0077.314] lstrcpyW (in: lpString1=0x1082b88, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.314] lstrcpyW (in: lpString1=0x10831e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.314] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.315] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="SplashScreen.bmp" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" [0077.315] PathFindFileNameW (pszPath="sqmapi.dll") returned="sqmapi.dll" [0077.315] _wcslwr (in: _String=0x2d3f3c4 | out: _String="sqmapi.dll") returned="sqmapi.dll" [0077.315] PathFindExtensionW (pszPath="sqmapi.dll") returned=".dll" [0077.315] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0077.315] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0077.315] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.315] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.315] PathFindFileNameW (pszPath="Strings.xml") returned="Strings.xml" [0077.315] _wcslwr (in: _String=0x2d3f3c4 | out: _String="strings.xml") returned="strings.xml" [0077.316] PathFindExtensionW (pszPath="Strings.xml") returned=".xml" [0077.316] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0077.316] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0077.316] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081c00 [0077.316] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082e48 [0077.316] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106ce08 [0077.316] lstrcpyW (in: lpString1=0x1082e48, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.316] lstrcpyW (in: lpString1=0x106ce08, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.316] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.316] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="Strings.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" [0077.316] PathFindFileNameW (pszPath="UiInfo.xml") returned="UiInfo.xml" [0077.316] _wcslwr (in: _String=0x2d3f3c4 | out: _String="uiinfo.xml") returned="uiinfo.xml" [0077.316] PathFindExtensionW (pszPath="UiInfo.xml") returned=".xml" [0077.316] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0077.316] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0077.316] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081c38 [0077.316] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082d40 [0077.316] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106ce90 [0077.316] lstrcpyW (in: lpString1=0x1082d40, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.316] lstrcpyW (in: lpString1=0x106ce90, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.316] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.316] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="UiInfo.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" [0077.317] PathFindFileNameW (pszPath="watermark.bmp") returned="watermark.bmp" [0077.317] _wcslwr (in: _String=0x2d3f3c4 | out: _String="watermark.bmp") returned="watermark.bmp" [0077.317] PathFindExtensionW (pszPath="watermark.bmp") returned=".bmp" [0077.317] lstrcatW (in: lpString1="", lpString2="bmp" | out: lpString1="bmp") returned="bmp" [0077.317] _wcslwr (in: _String=0x107b450 | out: _String="bmp") returned="bmp" [0077.317] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10817a0 [0077.317] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082ad8 [0077.317] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x1083280 [0077.317] lstrcpyW (in: lpString1=0x1082ad8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.317] lstrcpyW (in: lpString1=0x1083280, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.317] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\") returned="\\\\?\\C:\\588bce7c90097ed212\\" [0077.317] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\", lpString2="watermark.bmp" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp") returned="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" [0077.317] PathFindFileNameW (pszPath="Windows6.0-KB956250-v6001-x64.msu") returned="Windows6.0-KB956250-v6001-x64.msu" [0077.318] _wcslwr (in: _String=0x2d3f3c4 | out: _String="windows6.0-kb956250-v6001-x64.msu") returned="windows6.0-kb956250-v6001-x64.msu" [0077.318] PathFindExtensionW (pszPath="Windows6.0-KB956250-v6001-x64.msu") returned=".msu" [0077.318] lstrcatW (in: lpString1="", lpString2="msu" | out: lpString1="msu") returned="msu" [0077.318] _wcslwr (in: _String=0x107b450 | out: _String="msu") returned="msu" [0077.318] PathFindFileNameW (pszPath="Windows6.0-KB956250-v6001-x86.msu") returned="Windows6.0-KB956250-v6001-x86.msu" [0077.318] _wcslwr (in: _String=0x2d3f3c4 | out: _String="windows6.0-kb956250-v6001-x86.msu") returned="windows6.0-kb956250-v6001-x86.msu" [0077.318] PathFindExtensionW (pszPath="Windows6.0-KB956250-v6001-x86.msu") returned=".msu" [0077.318] lstrcatW (in: lpString1="", lpString2="msu" | out: lpString1="msu") returned="msu" [0077.319] _wcslwr (in: _String=0x107b450 | out: _String="msu") returned="msu" [0077.319] PathFindFileNameW (pszPath="Windows6.1-KB958488-v6001-x64.msu") returned="Windows6.1-KB958488-v6001-x64.msu" [0077.319] _wcslwr (in: _String=0x2d3f3c4 | out: _String="windows6.1-kb958488-v6001-x64.msu") returned="windows6.1-kb958488-v6001-x64.msu" [0077.319] PathFindExtensionW (pszPath="Windows6.1-KB958488-v6001-x64.msu") returned=".msu" [0077.319] lstrcatW (in: lpString1="", lpString2="msu" | out: lpString1="msu") returned="msu" [0077.319] _wcslwr (in: _String=0x107b450 | out: _String="msu") returned="msu" [0077.320] PathFindFileNameW (pszPath="Windows6.1-KB958488-v6001-x86.msu") returned="Windows6.1-KB958488-v6001-x86.msu" [0077.320] _wcslwr (in: _String=0x2d3f3c4 | out: _String="windows6.1-kb958488-v6001-x86.msu") returned="windows6.1-kb958488-v6001-x86.msu" [0077.320] PathFindExtensionW (pszPath="Windows6.1-KB958488-v6001-x86.msu") returned=".msu" [0077.320] lstrcatW (in: lpString1="", lpString2="msu" | out: lpString1="msu") returned="msu" [0077.320] _wcslwr (in: _String=0x107b450 | out: _String="msu") returned="msu" [0077.320] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.327] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.327] LocalFree (hMem=0x1071818) returned 0x0 [0077.327] NtClose (Handle=0x1b0) returned 0x0 [0077.328] GetProcessHeap () returned 0x1050000 [0077.328] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x106b100 | out: hHeap=0x1050000) returned 1 [0077.328] LocalFree (hMem=0x106e800) returned 0x0 [0077.328] LocalFree (hMem=0x1071610) returned 0x0 [0077.328] LocalFree (hMem=0x10713d0) returned 0x0 [0077.328] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Boot\\", cchMax=252 | out: psz1="C:\\Boot\\") returned="C:\\Boot\\" [0077.328] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.328] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.328] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.328] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.328] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.328] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.328] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.328] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.328] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.329] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.330] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.330] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.330] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.330] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.330] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.330] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.330] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.330] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.331] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.331] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.331] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.331] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.331] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.331] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.331] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.332] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.332] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.332] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.332] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.332] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.332] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.332] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.333] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.333] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.333] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.333] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.333] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.333] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.333] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.334] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.334] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.334] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.334] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.334] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.334] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.334] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.335] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.335] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.335] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.335] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.335] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.335] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.335] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.336] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.336] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.336] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.336] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.336] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.336] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.336] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.337] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.337] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.337] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.337] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.337] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.337] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.337] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.337] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0077.337] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.338] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.338] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.338] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.338] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.338] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.338] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.338] LocalFree (hMem=0x106da88) returned 0x0 [0077.338] LocalFree (hMem=0x10715f8) returned 0x0 [0077.338] LocalFree (hMem=0x1071628) returned 0x0 [0077.338] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Documents and Settings\\", cchMax=252 | out: psz1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0077.338] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.338] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.338] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.338] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.339] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.339] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.339] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.340] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.340] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.340] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.340] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.341] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.341] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.342] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.343] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.343] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.343] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.343] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.344] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.345] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.345] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.345] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.345] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.345] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.346] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.347] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.347] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.347] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.347] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.347] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.348] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.349] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.349] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.349] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.349] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.349] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.350] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Documents and Settings\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Documents and Settings\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.350] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Documents and Settings\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x0, IoStatusBlock=0x2d3fce4*(Status=0x2d3fcf8, Pointer=0x2d3fcf8, Information=0x74ceca73)) returned 0xc0000022 [0077.352] GetProcessHeap () returned 0x1050000 [0077.352] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x1062008 | out: hHeap=0x1050000) returned 1 [0077.352] LocalFree (hMem=0x106e6f8) returned 0x0 [0077.352] LocalFree (hMem=0x1071418) returned 0x0 [0077.352] LocalFree (hMem=0x10713b8) returned 0x0 [0077.352] StrCpyNW (in: psz1=0x106f114, psz2="C:\\ESD\\", cchMax=252 | out: psz1="C:\\ESD\\") returned="C:\\ESD\\" [0077.352] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.352] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.352] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.352] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.352] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.352] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.353] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.353] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.353] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.353] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.354] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.354] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.354] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.355] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.355] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.355] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.355] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.355] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.355] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.356] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.356] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.356] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.356] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.357] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.357] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.357] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.357] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.358] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.358] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.358] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.358] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.358] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.358] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.358] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.358] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.359] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.359] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.359] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.359] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.359] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.359] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.360] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.360] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.360] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.360] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.360] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.361] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.361] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.361] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.361] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.362] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.362] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.362] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.362] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.362] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.362] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.363] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.363] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.363] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.363] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.363] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.364] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.364] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.364] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.364] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.364] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.365] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.365] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.365] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.365] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.366] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.366] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.366] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.366] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.366] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.366] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.366] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.366] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.366] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.366] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.367] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.367] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.367] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.367] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.367] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.367] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.368] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.368] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.368] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.368] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.368] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.369] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.369] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.369] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.369] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.369] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.370] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.370] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.371] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.371] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.371] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.371] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.371] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.371] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.371] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.371] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.371] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.371] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.372] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.372] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.373] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.373] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.374] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.374] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.374] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.374] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.374] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.375] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.375] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.375] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.375] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.375] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.375] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.375] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.376] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.376] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.376] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.376] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.377] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.377] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.377] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.377] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.377] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.377] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.378] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.378] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.378] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.378] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.378] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.379] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.379] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.379] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.379] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.379] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.379] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.379] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.380] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.380] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.380] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.380] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.380] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.380] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.380] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.380] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.380] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.380] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.380] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.380] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.381] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.381] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.381] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.381] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.382] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.382] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.382] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.382] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.383] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.383] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.383] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.383] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.383] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.383] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.383] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.384] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.384] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.384] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.384] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.384] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.384] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.385] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.385] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.385] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.385] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.385] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.385] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.385] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.385] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.386] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.386] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.386] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.386] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.386] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ESD\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ESD\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.386] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ESD\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.390] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.390] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.390] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.390] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.390] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.390] LocalFree (hMem=0x1071818) returned 0x0 [0077.390] NtClose (Handle=0x1b0) returned 0x0 [0077.391] GetProcessHeap () returned 0x1050000 [0077.391] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x1066078 | out: hHeap=0x1050000) returned 1 [0077.391] LocalFree (hMem=0x106df20) returned 0x0 [0077.391] LocalFree (hMem=0x1071430) returned 0x0 [0077.391] LocalFree (hMem=0x10714d8) returned 0x0 [0077.391] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Logs\\", cchMax=252 | out: psz1="C:\\Logs\\") returned="C:\\Logs\\" [0077.391] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.391] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.391] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.391] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.391] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.391] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.391] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.391] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.391] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.391] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.391] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.391] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.391] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.392] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.392] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.392] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.392] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.392] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.392] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.392] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.393] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.393] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.393] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.393] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.393] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.394] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.394] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.394] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.394] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.395] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.395] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.395] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.395] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.395] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.395] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.395] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.396] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.396] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.396] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.396] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.396] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.397] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.397] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.397] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.397] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.397] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.397] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.397] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.398] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.398] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.398] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.398] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.398] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.399] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.399] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.399] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.399] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.399] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.400] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.400] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.400] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.400] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.400] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.401] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.401] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.401] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.401] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.402] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.402] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.402] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.402] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.402] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.403] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.403] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.403] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.403] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.403] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.403] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.403] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.403] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.405] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.405] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.406] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.406] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.406] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.407] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.407] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.407] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.408] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.408] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.408] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.408] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.409] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.409] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.409] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.409] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.409] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.410] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.410] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.410] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.410] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.411] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.411] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.411] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.411] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.411] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.411] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.412] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.412] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.412] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.412] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.412] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.412] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.412] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.412] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.413] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.413] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.413] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.414] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.414] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.414] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.414] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.414] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.414] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.414] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.414] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.415] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.415] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.415] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.415] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.416] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.416] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.416] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.416] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.416] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.417] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.417] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.418] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.418] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.418] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.418] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.418] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.418] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.418] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.418] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.418] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.419] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.419] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.419] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.428] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.429] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.429] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.429] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.429] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.429] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.429] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.429] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.430] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.430] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.430] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Logs\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Logs\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.430] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Logs\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.434] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.434] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.439] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.439] PathFindFileNameW (pszPath="Application.evtx") returned="Application.evtx" [0077.439] _wcslwr (in: _String=0x2d3f3c4 | out: _String="application.evtx") returned="application.evtx" [0077.439] PathFindExtensionW (pszPath="Application.evtx") returned=".evtx" [0077.439] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.439] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.439] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081570 [0077.439] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10815a8 [0077.439] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106d0b0 [0077.439] lstrcpyW (in: lpString1=0x10815a8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.439] lstrcpyW (in: lpString1=0x106d0b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.440] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.440] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Application.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Application.evtx") returned="\\\\?\\C:\\Logs\\Application.evtx" [0077.440] PathFindFileNameW (pszPath="HardwareEvents.evtx") returned="HardwareEvents.evtx" [0077.440] _wcslwr (in: _String=0x2d3f3c4 | out: _String="hardwareevents.evtx") returned="hardwareevents.evtx" [0077.440] PathFindExtensionW (pszPath="HardwareEvents.evtx") returned=".evtx" [0077.440] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.440] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.440] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10817d8 [0077.440] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081a40 [0077.440] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106c9c8 [0077.440] lstrcpyW (in: lpString1=0x1081a40, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.440] lstrcpyW (in: lpString1=0x106c9c8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.440] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.440] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="HardwareEvents.evtx" | out: lpString1="\\\\?\\C:\\Logs\\HardwareEvents.evtx") returned="\\\\?\\C:\\Logs\\HardwareEvents.evtx" [0077.441] PathFindFileNameW (pszPath="Internet Explorer.evtx") returned="Internet Explorer.evtx" [0077.441] _wcslwr (in: _String=0x2d3f3c4 | out: _String="internet explorer.evtx") returned="internet explorer.evtx" [0077.441] PathFindExtensionW (pszPath="Internet Explorer.evtx") returned=".evtx" [0077.441] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.441] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.441] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081960 [0077.441] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081810 [0077.441] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x106f558 [0077.441] lstrcpyW (in: lpString1=0x1081810, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.441] lstrcpyW (in: lpString1=0x106f558, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.441] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.441] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Internet Explorer.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Internet Explorer.evtx") returned="\\\\?\\C:\\Logs\\Internet Explorer.evtx" [0077.441] PathFindFileNameW (pszPath="Key Management Service.evtx") returned="Key Management Service.evtx" [0077.441] _wcslwr (in: _String=0x2d3f3c4 | out: _String="key management service.evtx") returned="key management service.evtx" [0077.441] PathFindExtensionW (pszPath="Key Management Service.evtx") returned=".evtx" [0077.441] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.441] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.442] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081768 [0077.442] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081a08 [0077.442] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x106f5f0 [0077.442] lstrcpyW (in: lpString1=0x1081a08, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.442] lstrcpyW (in: lpString1=0x106f5f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.442] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.442] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Key Management Service.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Key Management Service.evtx") returned="\\\\?\\C:\\Logs\\Key Management Service.evtx" [0077.442] PathFindFileNameW (pszPath="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="Microsoft-Client-Licensing-Platform%4Admin.evtx" [0077.442] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-client-licensing-platform%4admin.evtx") returned="microsoft-client-licensing-platform%4admin.evtx" [0077.442] PathFindExtensionW (pszPath="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned=".evtx" [0077.442] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.442] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.442] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081848 [0077.442] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081880 [0077.442] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080518 [0077.442] lstrcpyW (in: lpString1=0x1081880, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.442] lstrcpyW (in: lpString1=0x1080518, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.442] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.442] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" [0077.442] PathFindFileNameW (pszPath="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0077.442] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-application-experience%4program-compatibility-assistant.evtx") returned="microsoft-windows-application-experience%4program-compatibility-assistant.evtx" [0077.442] PathFindExtensionW (pszPath="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned=".evtx" [0077.442] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.443] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.443] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081998 [0077.443] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10818b8 [0077.443] LocalAlloc (uFlags=0x40, uBytes=0x170) returned 0x1083318 [0077.443] lstrcpyW (in: lpString1=0x10818b8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.443] lstrcpyW (in: lpString1=0x1083318, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.443] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.443] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0077.443] PathFindFileNameW (pszPath="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0077.443] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-applicationresourcemanagementsystem%4operational.evtx") returned="microsoft-windows-applicationresourcemanagementsystem%4operational.evtx" [0077.443] PathFindExtensionW (pszPath="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned=".evtx" [0077.443] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.443] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.443] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081ab0 [0077.443] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081650 [0077.443] LocalAlloc (uFlags=0x40, uBytes=0x150) returned 0x1083490 [0077.443] lstrcpyW (in: lpString1=0x1081650, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.444] lstrcpyW (in: lpString1=0x1083490, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.444] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.444] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0077.444] PathFindFileNameW (pszPath="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0077.444] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-applocker%4exe and dll.evtx") returned="microsoft-windows-applocker%4exe and dll.evtx" [0077.444] PathFindExtensionW (pszPath="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned=".evtx" [0077.444] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.444] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.444] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081ae8 [0077.444] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081b20 [0077.444] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107fd58 [0077.444] lstrcpyW (in: lpString1=0x1081b20, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.444] lstrcpyW (in: lpString1=0x107fd58, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.444] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.444] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0077.445] PathFindFileNameW (pszPath="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0077.445] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-applocker%4msi and script.evtx") returned="microsoft-windows-applocker%4msi and script.evtx" [0077.445] PathFindExtensionW (pszPath="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned=".evtx" [0077.445] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.445] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.445] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10815e0 [0077.445] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081ca8 [0077.445] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x10835e8 [0077.445] lstrcpyW (in: lpString1=0x1081ca8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.445] lstrcpyW (in: lpString1=0x10835e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.445] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.445] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0077.445] PathFindFileNameW (pszPath="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0077.445] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-applocker%4packaged app-deployment.evtx") returned="microsoft-windows-applocker%4packaged app-deployment.evtx" [0077.445] PathFindExtensionW (pszPath="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned=".evtx" [0077.445] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.445] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.445] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081ce0 [0077.446] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1081c70 [0077.446] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x10836f0 [0077.446] lstrcpyW (in: lpString1=0x1081c70, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.446] lstrcpyW (in: lpString1=0x10836f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.446] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.446] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0077.446] PathFindFileNameW (pszPath="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0077.446] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-applocker%4packaged app-execution.evtx") returned="microsoft-windows-applocker%4packaged app-execution.evtx" [0077.446] PathFindExtensionW (pszPath="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned=".evtx" [0077.446] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.446] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.446] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106df20 [0077.446] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106da88 [0077.446] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x1083818 [0077.446] lstrcpyW (in: lpString1=0x106da88, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.446] lstrcpyW (in: lpString1=0x1083818, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.446] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.447] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0077.447] PathFindFileNameW (pszPath="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0077.447] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appmodel-runtime%4admin.evtx") returned="microsoft-windows-appmodel-runtime%4admin.evtx" [0077.447] PathFindExtensionW (pszPath="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned=".evtx" [0077.447] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.447] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.447] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083d60 [0077.447] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083d98 [0077.447] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x107fe50 [0077.447] lstrcpyW (in: lpString1=0x1083d98, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.447] lstrcpyW (in: lpString1=0x107fe50, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.447] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.447] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0077.448] PathFindFileNameW (pszPath="Microsoft-Windows-AppReadiness%4Admin.evtx") returned="Microsoft-Windows-AppReadiness%4Admin.evtx" [0077.448] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appreadiness%4admin.evtx") returned="microsoft-windows-appreadiness%4admin.evtx" [0077.448] PathFindExtensionW (pszPath="Microsoft-Windows-AppReadiness%4Admin.evtx") returned=".evtx" [0077.448] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.448] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.448] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083ba0 [0077.448] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083a18 [0077.448] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1084148 [0077.448] lstrcpyW (in: lpString1=0x1083a18, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.448] lstrcpyW (in: lpString1=0x1084148, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.448] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.448] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" [0077.448] PathFindFileNameW (pszPath="Microsoft-Windows-AppReadiness%4Operational.evtx") returned="Microsoft-Windows-AppReadiness%4Operational.evtx" [0077.448] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appreadiness%4operational.evtx") returned="microsoft-windows-appreadiness%4operational.evtx" [0077.449] PathFindExtensionW (pszPath="Microsoft-Windows-AppReadiness%4Operational.evtx") returned=".evtx" [0077.449] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.449] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.449] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083dd0 [0077.449] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083fc8 [0077.449] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1084230 [0077.449] lstrcpyW (in: lpString1=0x1083fc8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.449] lstrcpyW (in: lpString1=0x1084230, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.449] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.449] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppReadiness%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" [0077.449] PathFindFileNameW (pszPath="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="Microsoft-Windows-AppXDeployment%4Operational.evtx" [0077.449] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appxdeployment%4operational.evtx") returned="microsoft-windows-appxdeployment%4operational.evtx" [0077.449] PathFindExtensionW (pszPath="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned=".evtx" [0077.449] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.449] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.449] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10839e0 [0077.449] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083e08 [0077.449] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1084338 [0077.449] lstrcpyW (in: lpString1=0x1083e08, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.449] lstrcpyW (in: lpString1=0x1084338, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.449] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.449] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" [0077.450] PathFindFileNameW (pszPath="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0077.450] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appxdeploymentserver%4operational.evtx") returned="microsoft-windows-appxdeploymentserver%4operational.evtx" [0077.450] PathFindExtensionW (pszPath="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned=".evtx" [0077.450] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.450] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.450] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10839a8 [0077.450] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083ac0 [0077.450] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x1084440 [0077.452] lstrcpyW (in: lpString1=0x1083ac0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.452] lstrcpyW (in: lpString1=0x1084440, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.452] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.452] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0077.452] PathFindFileNameW (pszPath="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0077.452] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appxdeploymentserver%4restricted.evtx") returned="microsoft-windows-appxdeploymentserver%4restricted.evtx" [0077.453] PathFindExtensionW (pszPath="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned=".evtx" [0077.453] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.453] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.453] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083f90 [0077.453] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083a50 [0077.453] LocalAlloc (uFlags=0x40, uBytes=0x110) returned 0x1084568 [0077.453] lstrcpyW (in: lpString1=0x1083a50, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.453] lstrcpyW (in: lpString1=0x1084568, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.453] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.453] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0077.453] PathFindFileNameW (pszPath="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="Microsoft-Windows-AppxPackaging%4Operational.evtx" [0077.453] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-appxpackaging%4operational.evtx") returned="microsoft-windows-appxpackaging%4operational.evtx" [0077.453] PathFindExtensionW (pszPath="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned=".evtx" [0077.453] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.453] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.453] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083ee8 [0077.453] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083e40 [0077.453] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1084680 [0077.453] lstrcpyW (in: lpString1=0x1083e40, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.453] lstrcpyW (in: lpString1=0x1084680, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.454] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.454] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" [0077.454] PathFindFileNameW (pszPath="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0077.454] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-backgroundtaskinfrastructure%4operational.evtx") returned="microsoft-windows-backgroundtaskinfrastructure%4operational.evtx" [0077.454] PathFindExtensionW (pszPath="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned=".evtx" [0077.454] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.454] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.454] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083c10 [0077.454] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083eb0 [0077.454] LocalAlloc (uFlags=0x40, uBytes=0x140) returned 0x1084788 [0077.454] lstrcpyW (in: lpString1=0x1083eb0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.454] lstrcpyW (in: lpString1=0x1084788, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.455] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.455] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0077.455] PathFindFileNameW (pszPath="Microsoft-Windows-Bits-Client%4Operational.evtx") returned="Microsoft-Windows-Bits-Client%4Operational.evtx" [0077.455] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-bits-client%4operational.evtx") returned="microsoft-windows-bits-client%4operational.evtx" [0077.455] PathFindExtensionW (pszPath="Microsoft-Windows-Bits-Client%4Operational.evtx") returned=".evtx" [0077.455] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.455] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.455] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1084000 [0077.455] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083f20 [0077.455] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080040 [0077.455] lstrcpyW (in: lpString1=0x1083f20, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.455] lstrcpyW (in: lpString1=0x1080040, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.455] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.455] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Bits-Client%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" [0077.455] PathFindFileNameW (pszPath="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0077.455] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-codeintegrity%4operational.evtx") returned="microsoft-windows-codeintegrity%4operational.evtx" [0077.455] PathFindExtensionW (pszPath="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned=".evtx" [0077.455] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.456] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.456] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083af8 [0077.456] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083b30 [0077.456] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x10848d0 [0077.456] lstrcpyW (in: lpString1=0x1083b30, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.456] lstrcpyW (in: lpString1=0x10848d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.456] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.456] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0077.456] PathFindFileNameW (pszPath="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0077.456] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-coresystem-smsrouter-events%4operational.evtx") returned="microsoft-windows-coresystem-smsrouter-events%4operational.evtx" [0077.456] PathFindExtensionW (pszPath="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned=".evtx" [0077.456] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.456] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.456] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083a88 [0077.456] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083cb8 [0077.456] LocalAlloc (uFlags=0x40, uBytes=0x130) returned 0x10849d8 [0077.456] lstrcpyW (in: lpString1=0x1083cb8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.457] lstrcpyW (in: lpString1=0x10849d8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.457] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.457] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0077.457] PathFindFileNameW (pszPath="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0077.457] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-crypto-dpapi%4backupkeysvc.evtx") returned="microsoft-windows-crypto-dpapi%4backupkeysvc.evtx" [0077.457] PathFindExtensionW (pszPath="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned=".evtx" [0077.457] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.457] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.457] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083f58 [0077.457] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1084038 [0077.457] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1084b10 [0077.457] lstrcpyW (in: lpString1=0x1084038, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.457] lstrcpyW (in: lpString1=0x1084b10, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.457] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.457] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0077.457] PathFindFileNameW (pszPath="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0077.457] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-crypto-dpapi%4operational.evtx") returned="microsoft-windows-crypto-dpapi%4operational.evtx" [0077.457] PathFindExtensionW (pszPath="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned=".evtx" [0077.457] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.457] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.457] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083b68 [0077.458] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083970 [0077.458] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1084c18 [0077.458] lstrcpyW (in: lpString1=0x1083970, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.458] lstrcpyW (in: lpString1=0x1084c18, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.458] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.458] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0077.458] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.459] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.459] PathFindFileNameW (pszPath="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0077.459] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx") returned="microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx" [0077.459] PathFindExtensionW (pszPath="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned=".evtx" [0077.459] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.459] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.459] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083e78 [0077.459] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083d28 [0077.459] LocalAlloc (uFlags=0x40, uBytes=0x170) returned 0x1084d20 [0077.460] lstrcpyW (in: lpString1=0x1083d28, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.460] lstrcpyW (in: lpString1=0x1084d20, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.460] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.460] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0077.460] PathFindFileNameW (pszPath="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0077.460] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-devicesetupmanager%4admin.evtx") returned="microsoft-windows-devicesetupmanager%4admin.evtx" [0077.460] PathFindExtensionW (pszPath="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned=".evtx" [0077.460] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.460] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.460] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083bd8 [0077.460] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083c48 [0077.460] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1084e98 [0077.460] lstrcpyW (in: lpString1=0x1083c48, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.460] lstrcpyW (in: lpString1=0x1084e98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.460] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.460] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0077.460] PathFindFileNameW (pszPath="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0077.460] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-devicesetupmanager%4operational.evtx") returned="microsoft-windows-devicesetupmanager%4operational.evtx" [0077.460] PathFindExtensionW (pszPath="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned=".evtx" [0077.460] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.460] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.460] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083c80 [0077.461] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1083cf0 [0077.461] LocalAlloc (uFlags=0x40, uBytes=0x110) returned 0x1084fa0 [0077.461] lstrcpyW (in: lpString1=0x1083cf0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.461] lstrcpyW (in: lpString1=0x1084fa0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.461] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.461] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0077.461] PathFindFileNameW (pszPath="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0077.461] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-dhcp-client%4admin.evtx") returned="microsoft-windows-dhcp-client%4admin.evtx" [0077.461] PathFindExtensionW (pszPath="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned=".evtx" [0077.461] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.461] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.461] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10840e0 [0077.461] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1084070 [0077.461] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x10850b8 [0077.461] lstrcpyW (in: lpString1=0x1084070, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.461] lstrcpyW (in: lpString1=0x10850b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.462] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.462] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0077.462] PathFindFileNameW (pszPath="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0077.462] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-dhcpv6-client%4admin.evtx") returned="microsoft-windows-dhcpv6-client%4admin.evtx" [0077.462] PathFindExtensionW (pszPath="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned=".evtx" [0077.462] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.462] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.462] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10840a8 [0077.462] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085748 [0077.462] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x10859a8 [0077.462] lstrcpyW (in: lpString1=0x1085748, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.462] lstrcpyW (in: lpString1=0x10859a8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.462] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.462] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0077.462] PathFindFileNameW (pszPath="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0077.463] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-diagnosis-dps%4operational.evtx") returned="microsoft-windows-diagnosis-dps%4operational.evtx" [0077.463] PathFindExtensionW (pszPath="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned=".evtx" [0077.463] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.463] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.463] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085400 [0077.463] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085588 [0077.463] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1085a90 [0077.463] lstrcpyW (in: lpString1=0x1085588, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.463] lstrcpyW (in: lpString1=0x1085a90, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.463] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.463] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0077.463] PathFindFileNameW (pszPath="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0077.463] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-diagnostics-performance%4operational.evtx") returned="microsoft-windows-diagnostics-performance%4operational.evtx" [0077.463] PathFindExtensionW (pszPath="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned=".evtx" [0077.463] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.463] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.463] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085438 [0077.463] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085320 [0077.463] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x1085b98 [0077.463] lstrcpyW (in: lpString1=0x1085320, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.464] lstrcpyW (in: lpString1=0x1085b98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.464] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.464] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0077.464] PathFindFileNameW (pszPath="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="Microsoft-Windows-GroupPolicy%4Operational.evtx" [0077.464] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-grouppolicy%4operational.evtx") returned="microsoft-windows-grouppolicy%4operational.evtx" [0077.464] PathFindExtensionW (pszPath="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned=".evtx" [0077.464] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.464] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.464] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085518 [0077.464] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085668 [0077.464] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1080138 [0077.464] lstrcpyW (in: lpString1=0x1085668, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.464] lstrcpyW (in: lpString1=0x1080138, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.464] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.464] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" [0077.464] PathFindFileNameW (pszPath="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="Microsoft-Windows-HotspotAuth%4Operational.evtx" [0077.464] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-hotspotauth%4operational.evtx") returned="microsoft-windows-hotspotauth%4operational.evtx" [0077.464] PathFindExtensionW (pszPath="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned=".evtx" [0077.465] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.465] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.465] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085860 [0077.465] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085780 [0077.465] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1085ce8 [0077.465] lstrcpyW (in: lpString1=0x1085780, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.465] lstrcpyW (in: lpString1=0x1085ce8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.465] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.465] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" [0077.465] PathFindFileNameW (pszPath="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0077.467] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-hyper-v-guest-drivers%4admin.evtx") returned="microsoft-windows-hyper-v-guest-drivers%4admin.evtx" [0077.467] PathFindExtensionW (pszPath="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned=".evtx" [0077.467] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.467] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.467] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085898 [0077.467] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10852e8 [0077.467] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1087cc8 [0077.467] lstrcpyW (in: lpString1=0x10852e8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.467] lstrcpyW (in: lpString1=0x1087cc8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.467] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.467] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0077.468] PathFindFileNameW (pszPath="Microsoft-Windows-International%4Operational.evtx") returned="Microsoft-Windows-International%4Operational.evtx" [0077.468] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-international%4operational.evtx") returned="microsoft-windows-international%4operational.evtx" [0077.468] PathFindExtensionW (pszPath="Microsoft-Windows-International%4Operational.evtx") returned=".evtx" [0077.468] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.468] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.468] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10855f8 [0077.468] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10853c8 [0077.468] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1087dd0 [0077.468] lstrcpyW (in: lpString1=0x10853c8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.468] lstrcpyW (in: lpString1=0x1087dd0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.468] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.468] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-International%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" [0077.469] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0077.469] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-boot%4operational.evtx") returned="microsoft-windows-kernel-boot%4operational.evtx" [0077.469] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned=".evtx" [0077.469] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.469] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.469] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10854a8 [0077.469] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10857b8 [0077.469] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086790 [0077.469] lstrcpyW (in: lpString1=0x10857b8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.469] lstrcpyW (in: lpString1=0x1086790, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.469] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.469] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0077.469] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0077.469] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-eventtracing%4admin.evtx") returned="microsoft-windows-kernel-eventtracing%4admin.evtx" [0077.469] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned=".evtx" [0077.469] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.469] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.470] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085240 [0077.470] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10856a0 [0077.470] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1087ed8 [0077.470] lstrcpyW (in: lpString1=0x10856a0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.470] lstrcpyW (in: lpString1=0x1087ed8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.470] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.470] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0077.470] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0077.470] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-pnp%4configuration.evtx") returned="microsoft-windows-kernel-pnp%4configuration.evtx" [0077.470] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned=".evtx" [0077.470] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.470] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.470] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085358 [0077.470] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085470 [0077.470] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1087fe0 [0077.470] lstrcpyW (in: lpString1=0x1085470, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.470] lstrcpyW (in: lpString1=0x1087fe0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.470] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.470] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0077.471] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0077.471] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-power%4thermal-operational.evtx") returned="microsoft-windows-kernel-power%4thermal-operational.evtx" [0077.471] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned=".evtx" [0077.471] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.471] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.471] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10857f0 [0077.471] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085208 [0077.471] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x10880e8 [0077.471] lstrcpyW (in: lpString1=0x1085208, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.471] lstrcpyW (in: lpString1=0x10880e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.471] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.471] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0077.471] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0077.471] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-shimengine%4operational.evtx") returned="microsoft-windows-kernel-shimengine%4operational.evtx" [0077.471] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned=".evtx" [0077.471] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.471] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.471] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10851d0 [0077.471] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085278 [0077.471] LocalAlloc (uFlags=0x40, uBytes=0x110) returned 0x1088210 [0077.471] lstrcpyW (in: lpString1=0x1085278, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.472] lstrcpyW (in: lpString1=0x1088210, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.472] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.472] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0077.472] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0077.472] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-storemgr%4operational.evtx") returned="microsoft-windows-kernel-storemgr%4operational.evtx" [0077.472] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned=".evtx" [0077.472] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.472] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.472] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10856d8 [0077.472] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085828 [0077.472] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1088328 [0077.472] lstrcpyW (in: lpString1=0x1085828, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.472] lstrcpyW (in: lpString1=0x1088328, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.472] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.472] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0077.472] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0077.472] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-whea%4errors.evtx") returned="microsoft-windows-kernel-whea%4errors.evtx" [0077.472] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned=".evtx" [0077.472] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.472] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.472] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085710 [0077.472] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085550 [0077.473] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1088430 [0077.473] lstrcpyW (in: lpString1=0x1085550, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.473] lstrcpyW (in: lpString1=0x1088430, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.473] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.473] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0077.473] PathFindFileNameW (pszPath="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0077.473] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-kernel-whea%4operational.evtx") returned="microsoft-windows-kernel-whea%4operational.evtx" [0077.473] PathFindExtensionW (pszPath="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned=".evtx" [0077.473] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.473] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.473] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085630 [0077.473] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10852b0 [0077.473] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1085fd0 [0077.473] lstrcpyW (in: lpString1=0x10852b0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.473] lstrcpyW (in: lpString1=0x1085fd0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.473] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.473] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0077.474] PathFindFileNameW (pszPath="Microsoft-Windows-Known Folders API Service.evtx") returned="Microsoft-Windows-Known Folders API Service.evtx" [0077.474] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-known folders api service.evtx") returned="microsoft-windows-known folders api service.evtx" [0077.474] PathFindExtensionW (pszPath="Microsoft-Windows-Known Folders API Service.evtx") returned=".evtx" [0077.474] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.474] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.474] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10854e0 [0077.474] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085390 [0077.474] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1088518 [0077.474] lstrcpyW (in: lpString1=0x1085390, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.474] lstrcpyW (in: lpString1=0x1088518, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.474] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.474] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Known Folders API Service.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" [0077.474] PathFindFileNameW (pszPath="Microsoft-Windows-LiveId%4Operational.evtx") returned="Microsoft-Windows-LiveId%4Operational.evtx" [0077.474] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-liveid%4operational.evtx") returned="microsoft-windows-liveid%4operational.evtx" [0077.474] PathFindExtensionW (pszPath="Microsoft-Windows-LiveId%4Operational.evtx") returned=".evtx" [0077.474] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.474] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.474] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10855c0 [0077.474] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10858d0 [0077.475] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1088620 [0077.475] lstrcpyW (in: lpString1=0x10858d0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.475] lstrcpyW (in: lpString1=0x1088620, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.475] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.475] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-LiveId%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" [0077.475] PathFindFileNameW (pszPath="Microsoft-Windows-MUI%4Admin.evtx") returned="Microsoft-Windows-MUI%4Admin.evtx" [0077.475] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-mui%4admin.evtx") returned="microsoft-windows-mui%4admin.evtx" [0077.475] PathFindExtensionW (pszPath="Microsoft-Windows-MUI%4Admin.evtx") returned=".evtx" [0077.475] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.475] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.475] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085908 [0077.475] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1085940 [0077.475] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x106f698 [0077.475] lstrcpyW (in: lpString1=0x1085940, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.475] lstrcpyW (in: lpString1=0x106f698, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.475] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.475] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" [0077.475] PathFindFileNameW (pszPath="Microsoft-Windows-MUI%4Operational.evtx") returned="Microsoft-Windows-MUI%4Operational.evtx" [0077.476] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-mui%4operational.evtx") returned="microsoft-windows-mui%4operational.evtx" [0077.476] PathFindExtensionW (pszPath="Microsoft-Windows-MUI%4Operational.evtx") returned=".evtx" [0077.476] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.476] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.476] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10889d8 [0077.476] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088a48 [0077.476] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1067858 [0077.476] lstrcpyW (in: lpString1=0x1088a48, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.476] lstrcpyW (in: lpString1=0x1067858, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.476] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.476] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-MUI%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" [0077.476] PathFindFileNameW (pszPath="Microsoft-Windows-NCSI%4Operational.evtx") returned="Microsoft-Windows-NCSI%4Operational.evtx" [0077.476] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-ncsi%4operational.evtx") returned="microsoft-windows-ncsi%4operational.evtx" [0077.476] PathFindExtensionW (pszPath="Microsoft-Windows-NCSI%4Operational.evtx") returned=".evtx" [0077.476] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.476] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.476] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088c78 [0077.477] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088a80 [0077.477] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1088f10 [0077.477] lstrcpyW (in: lpString1=0x1088a80, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.477] lstrcpyW (in: lpString1=0x1088f10, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.477] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.477] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-NCSI%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" [0077.477] PathFindFileNameW (pszPath="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="Microsoft-Windows-NetworkProfile%4Operational.evtx" [0077.478] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-networkprofile%4operational.evtx") returned="microsoft-windows-networkprofile%4operational.evtx" [0077.478] PathFindExtensionW (pszPath="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned=".evtx" [0077.478] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.478] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.478] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088818 [0077.478] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088a10 [0077.478] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1089968 [0077.479] lstrcpyW (in: lpString1=0x1088a10, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.479] lstrcpyW (in: lpString1=0x1089968, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.479] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.479] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" [0077.479] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.495] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.495] PathFindFileNameW (pszPath="Microsoft-Windows-Ntfs%4Operational.evtx") returned="Microsoft-Windows-Ntfs%4Operational.evtx" [0077.495] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-ntfs%4operational.evtx") returned="microsoft-windows-ntfs%4operational.evtx" [0077.495] PathFindExtensionW (pszPath="Microsoft-Windows-Ntfs%4Operational.evtx") returned=".evtx" [0077.495] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.495] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.495] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088ab8 [0077.495] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088af0 [0077.495] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108a000 [0077.495] lstrcpyW (in: lpString1=0x1088af0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.495] lstrcpyW (in: lpString1=0x108a000, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.495] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.495] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Ntfs%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" [0077.496] PathFindFileNameW (pszPath="Microsoft-Windows-Ntfs%4WHC.evtx") returned="Microsoft-Windows-Ntfs%4WHC.evtx" [0077.496] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-ntfs%4whc.evtx") returned="microsoft-windows-ntfs%4whc.evtx" [0077.496] PathFindExtensionW (pszPath="Microsoft-Windows-Ntfs%4WHC.evtx") returned=".evtx" [0077.496] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.496] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.496] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088e00 [0077.496] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088850 [0077.496] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x108a0e8 [0077.496] lstrcpyW (in: lpString1=0x1088850, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.496] lstrcpyW (in: lpString1=0x108a0e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.496] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.496] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Ntfs%4WHC.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" [0077.496] PathFindFileNameW (pszPath="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0077.496] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx") returned="microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx" [0077.496] PathFindExtensionW (pszPath="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned=".evtx" [0077.496] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.496] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.496] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088d58 [0077.496] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088770 [0077.496] LocalAlloc (uFlags=0x40, uBytes=0x160) returned 0x108a1b0 [0077.496] lstrcpyW (in: lpString1=0x1088770, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.496] lstrcpyW (in: lpString1=0x108a1b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.497] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.497] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0077.497] PathFindFileNameW (pszPath="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="Microsoft-Windows-ReadyBoost%4Operational.evtx" [0077.497] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-readyboost%4operational.evtx") returned="microsoft-windows-readyboost%4operational.evtx" [0077.497] PathFindExtensionW (pszPath="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned=".evtx" [0077.497] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.497] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.497] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088dc8 [0077.497] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088930 [0077.497] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086b70 [0077.497] lstrcpyW (in: lpString1=0x1088930, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.498] lstrcpyW (in: lpString1=0x1086b70, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.498] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.498] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" [0077.498] PathFindFileNameW (pszPath="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0077.498] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-resource-exhaustion-detector%4operational.evtx") returned="microsoft-windows-resource-exhaustion-detector%4operational.evtx" [0077.498] PathFindExtensionW (pszPath="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned=".evtx" [0077.498] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.498] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.498] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088ce8 [0077.498] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088b98 [0077.498] LocalAlloc (uFlags=0x40, uBytes=0x140) returned 0x108a318 [0077.498] lstrcpyW (in: lpString1=0x1088b98, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.498] lstrcpyW (in: lpString1=0x108a318, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.498] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.498] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0077.498] PathFindFileNameW (pszPath="Microsoft-Windows-SettingSync%4Debug.evtx") returned="Microsoft-Windows-SettingSync%4Debug.evtx" [0077.498] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-settingsync%4debug.evtx") returned="microsoft-windows-settingsync%4debug.evtx" [0077.498] PathFindExtensionW (pszPath="Microsoft-Windows-SettingSync%4Debug.evtx") returned=".evtx" [0077.498] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.498] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.498] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088738 [0077.498] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088b28 [0077.498] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108a460 [0077.499] lstrcpyW (in: lpString1=0x1088b28, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.499] lstrcpyW (in: lpString1=0x108a460, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.499] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.499] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SettingSync%4Debug.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" [0077.499] PathFindFileNameW (pszPath="Microsoft-Windows-SettingSync%4Operational.evtx") returned="Microsoft-Windows-SettingSync%4Operational.evtx" [0077.499] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-settingsync%4operational.evtx") returned="microsoft-windows-settingsync%4operational.evtx" [0077.499] PathFindExtensionW (pszPath="Microsoft-Windows-SettingSync%4Operational.evtx") returned=".evtx" [0077.499] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.499] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.499] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10887a8 [0077.499] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10887e0 [0077.499] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086980 [0077.499] lstrcpyW (in: lpString1=0x10887e0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.499] lstrcpyW (in: lpString1=0x1086980, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.499] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.499] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SettingSync%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" [0077.499] PathFindFileNameW (pszPath="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0077.499] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-shell-core%4actioncenter.evtx") returned="microsoft-windows-shell-core%4actioncenter.evtx" [0077.499] PathFindExtensionW (pszPath="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned=".evtx" [0077.499] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.499] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.499] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088888 [0077.499] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088c08 [0077.499] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087af0 [0077.499] lstrcpyW (in: lpString1=0x1088c08, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.499] lstrcpyW (in: lpString1=0x1087af0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.499] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.500] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0077.500] PathFindFileNameW (pszPath="Microsoft-Windows-Shell-Core%4Operational.evtx") returned="Microsoft-Windows-Shell-Core%4Operational.evtx" [0077.500] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-shell-core%4operational.evtx") returned="microsoft-windows-shell-core%4operational.evtx" [0077.500] PathFindExtensionW (pszPath="Microsoft-Windows-Shell-Core%4Operational.evtx") returned=".evtx" [0077.500] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.500] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.500] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088bd0 [0077.500] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088b60 [0077.500] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086698 [0077.500] lstrcpyW (in: lpString1=0x1088b60, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.500] lstrcpyW (in: lpString1=0x1086698, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.500] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.500] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Shell-Core%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" [0077.500] PathFindFileNameW (pszPath="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="Microsoft-Windows-SmbClient%4Connectivity.evtx" [0077.500] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbclient%4connectivity.evtx") returned="microsoft-windows-smbclient%4connectivity.evtx" [0077.500] PathFindExtensionW (pszPath="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned=".evtx" [0077.500] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.500] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.500] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088d90 [0077.500] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10888c0 [0077.500] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10864a8 [0077.500] lstrcpyW (in: lpString1=0x10888c0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.500] lstrcpyW (in: lpString1=0x10864a8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.500] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.500] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" [0077.501] PathFindFileNameW (pszPath="Microsoft-Windows-SMBClient%4Operational.evtx") returned="Microsoft-Windows-SMBClient%4Operational.evtx" [0077.501] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbclient%4operational.evtx") returned="microsoft-windows-smbclient%4operational.evtx" [0077.501] PathFindExtensionW (pszPath="Microsoft-Windows-SMBClient%4Operational.evtx") returned=".evtx" [0077.501] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.501] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.501] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088c40 [0077.501] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10888f8 [0077.501] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086888 [0077.501] lstrcpyW (in: lpString1=0x10888f8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.501] lstrcpyW (in: lpString1=0x1086888, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.501] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.501] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SMBClient%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" [0077.501] PathFindFileNameW (pszPath="Microsoft-Windows-SmbClient%4Security.evtx") returned="Microsoft-Windows-SmbClient%4Security.evtx" [0077.501] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbclient%4security.evtx") returned="microsoft-windows-smbclient%4security.evtx" [0077.501] PathFindExtensionW (pszPath="Microsoft-Windows-SmbClient%4Security.evtx") returned=".evtx" [0077.501] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.501] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.501] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088cb0 [0077.501] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088d20 [0077.501] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108a548 [0077.501] lstrcpyW (in: lpString1=0x1088d20, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.501] lstrcpyW (in: lpString1=0x108a548, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.501] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.501] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SmbClient%4Security.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" [0077.501] PathFindFileNameW (pszPath="Microsoft-Windows-SMBServer%4Audit.evtx") returned="Microsoft-Windows-SMBServer%4Audit.evtx" [0077.501] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbserver%4audit.evtx") returned="microsoft-windows-smbserver%4audit.evtx" [0077.502] PathFindExtensionW (pszPath="Microsoft-Windows-SMBServer%4Audit.evtx") returned=".evtx" [0077.502] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.502] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.502] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088968 [0077.502] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10889a0 [0077.502] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1067f18 [0077.502] lstrcpyW (in: lpString1=0x10889a0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.502] lstrcpyW (in: lpString1=0x1067f18, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.502] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.502] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Audit.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" [0077.502] PathFindFileNameW (pszPath="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="Microsoft-Windows-SMBServer%4Connectivity.evtx" [0077.502] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbserver%4connectivity.evtx") returned="microsoft-windows-smbserver%4connectivity.evtx" [0077.502] PathFindExtensionW (pszPath="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned=".evtx" [0077.502] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.502] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.502] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088e70 [0077.502] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088ea8 [0077.502] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086a78 [0077.502] lstrcpyW (in: lpString1=0x1088ea8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.502] lstrcpyW (in: lpString1=0x1086a78, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.502] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.502] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Connectivity.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" [0077.502] PathFindFileNameW (pszPath="Microsoft-Windows-SMBServer%4Operational.evtx") returned="Microsoft-Windows-SMBServer%4Operational.evtx" [0077.502] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbserver%4operational.evtx") returned="microsoft-windows-smbserver%4operational.evtx" [0077.502] PathFindExtensionW (pszPath="Microsoft-Windows-SMBServer%4Operational.evtx") returned=".evtx" [0077.503] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.503] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.503] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1088e38 [0077.503] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108acb8 [0077.503] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1085de0 [0077.503] lstrcpyW (in: lpString1=0x108acb8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.503] lstrcpyW (in: lpString1=0x1085de0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.503] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.503] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" [0077.503] PathFindFileNameW (pszPath="Microsoft-Windows-SMBServer%4Security.evtx") returned="Microsoft-Windows-SMBServer%4Security.evtx" [0077.503] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-smbserver%4security.evtx") returned="microsoft-windows-smbserver%4security.evtx" [0077.503] PathFindExtensionW (pszPath="Microsoft-Windows-SMBServer%4Security.evtx") returned=".evtx" [0077.503] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.503] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.503] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a7e8 [0077.503] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a890 [0077.503] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108ae38 [0077.503] lstrcpyW (in: lpString1=0x108a890, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.503] lstrcpyW (in: lpString1=0x108ae38, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.503] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.503] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-SMBServer%4Security.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" [0077.504] PathFindFileNameW (pszPath="Microsoft-Windows-Store%4Operational.evtx") returned="Microsoft-Windows-Store%4Operational.evtx" [0077.504] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-store%4operational.evtx") returned="microsoft-windows-store%4operational.evtx" [0077.504] PathFindExtensionW (pszPath="Microsoft-Windows-Store%4Operational.evtx") returned=".evtx" [0077.504] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.504] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.504] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ab30 [0077.504] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ac10 [0077.504] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108af20 [0077.504] lstrcpyW (in: lpString1=0x108ac10, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.504] lstrcpyW (in: lpString1=0x108af20, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.504] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.504] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Store%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" [0077.504] PathFindFileNameW (pszPath="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="Microsoft-Windows-TaskScheduler%4Maintenance.evtx" [0077.504] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-taskscheduler%4maintenance.evtx") returned="microsoft-windows-taskscheduler%4maintenance.evtx" [0077.504] PathFindExtensionW (pszPath="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned=".evtx" [0077.504] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.504] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.504] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a900 [0077.504] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a970 [0077.504] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1089c80 [0077.504] lstrcpyW (in: lpString1=0x108a970, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.504] lstrcpyW (in: lpString1=0x1089c80, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.505] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.505] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-TaskScheduler%4Maintenance.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" [0077.505] PathFindFileNameW (pszPath="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0077.505] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-terminalservices-localsessionmanager%4admin.evtx") returned="microsoft-windows-terminalservices-localsessionmanager%4admin.evtx" [0077.505] PathFindExtensionW (pszPath="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned=".evtx" [0077.505] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.505] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.505] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a8c8 [0077.505] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a938 [0077.505] LocalAlloc (uFlags=0x40, uBytes=0x140) returned 0x108b008 [0077.505] lstrcpyW (in: lpString1=0x108a938, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.505] lstrcpyW (in: lpString1=0x108b008, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.505] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.505] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0077.505] PathFindFileNameW (pszPath="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" [0077.505] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-terminalservices-localsessionmanager%4operational.evtx") returned="microsoft-windows-terminalservices-localsessionmanager%4operational.evtx" [0077.505] PathFindExtensionW (pszPath="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned=".evtx" [0077.505] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.505] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.505] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a9a8 [0077.505] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a9e0 [0077.505] LocalAlloc (uFlags=0x40, uBytes=0x160) returned 0x108b150 [0077.505] lstrcpyW (in: lpString1=0x108a9e0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.505] lstrcpyW (in: lpString1=0x108b150, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.505] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.505] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" [0077.506] PathFindFileNameW (pszPath="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0077.506] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx") returned="microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx" [0077.506] PathFindExtensionW (pszPath="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned=".evtx" [0077.506] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.506] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.506] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108aa18 [0077.506] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108aa50 [0077.506] LocalAlloc (uFlags=0x40, uBytes=0x150) returned 0x108b2b8 [0077.506] lstrcpyW (in: lpString1=0x108aa50, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.506] lstrcpyW (in: lpString1=0x108b2b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.506] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.506] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0077.506] PathFindFileNameW (pszPath="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0077.506] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx") returned="microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx" [0077.506] PathFindExtensionW (pszPath="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned=".evtx" [0077.506] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.506] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.506] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108aa88 [0077.506] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a6d0 [0077.506] LocalAlloc (uFlags=0x40, uBytes=0x170) returned 0x108b410 [0077.506] lstrcpyW (in: lpString1=0x108a6d0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.506] lstrcpyW (in: lpString1=0x108b410, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.507] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.507] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0077.507] PathFindFileNameW (pszPath="Microsoft-Windows-TWinUI%4Operational.evtx") returned="Microsoft-Windows-TWinUI%4Operational.evtx" [0077.507] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-twinui%4operational.evtx") returned="microsoft-windows-twinui%4operational.evtx" [0077.507] PathFindExtensionW (pszPath="Microsoft-Windows-TWinUI%4Operational.evtx") returned=".evtx" [0077.507] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.507] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.507] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ac48 [0077.507] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a740 [0077.507] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108b588 [0077.507] lstrcpyW (in: lpString1=0x108a740, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.507] lstrcpyW (in: lpString1=0x108b588, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.507] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.507] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-TWinUI%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" [0077.507] PathFindFileNameW (pszPath="Microsoft-Windows-User Profile Service%4Operational.evtx") returned="Microsoft-Windows-User Profile Service%4Operational.evtx" [0077.507] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-user profile service%4operational.evtx") returned="microsoft-windows-user profile service%4operational.evtx" [0077.507] PathFindExtensionW (pszPath="Microsoft-Windows-User Profile Service%4Operational.evtx") returned=".evtx" [0077.507] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.507] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.507] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a820 [0077.508] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108aac0 [0077.508] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x108b670 [0077.508] lstrcpyW (in: lpString1=0x108aac0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.508] lstrcpyW (in: lpString1=0x108b670, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.508] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.508] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-User Profile Service%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" [0077.508] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.509] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.509] PathFindFileNameW (pszPath="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0077.509] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-userpnp%4actioncenter.evtx") returned="microsoft-windows-userpnp%4actioncenter.evtx" [0077.509] PathFindExtensionW (pszPath="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned=".evtx" [0077.509] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.509] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.509] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108abd8 [0077.509] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108aaf8 [0077.509] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087520 [0077.510] lstrcpyW (in: lpString1=0x108aaf8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.510] lstrcpyW (in: lpString1=0x1087520, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.510] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.510] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0077.510] PathFindFileNameW (pszPath="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0077.510] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-userpnp%4deviceinstall.evtx") returned="microsoft-windows-userpnp%4deviceinstall.evtx" [0077.510] PathFindExtensionW (pszPath="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned=".evtx" [0077.510] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.510] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.510] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108acf0 [0077.510] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ac80 [0077.510] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087140 [0077.510] lstrcpyW (in: lpString1=0x108ac80, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.510] lstrcpyW (in: lpString1=0x1087140, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.510] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.510] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0077.510] PathFindFileNameW (pszPath="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0077.510] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-volumesnapshot-driver%4operational.evtx") returned="microsoft-windows-volumesnapshot-driver%4operational.evtx" [0077.510] PathFindExtensionW (pszPath="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned=".evtx" [0077.510] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.510] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.510] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ab68 [0077.510] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108aba0 [0077.510] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x108b798 [0077.510] lstrcpyW (in: lpString1=0x108aba0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.511] lstrcpyW (in: lpString1=0x108b798, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.511] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.511] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0077.511] PathFindFileNameW (pszPath="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="Microsoft-Windows-Wcmsvc%4Operational.evtx" [0077.511] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-wcmsvc%4operational.evtx") returned="microsoft-windows-wcmsvc%4operational.evtx" [0077.511] PathFindExtensionW (pszPath="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned=".evtx" [0077.511] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.511] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.511] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ad28 [0077.511] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a7b0 [0077.511] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108b8c0 [0077.511] lstrcpyW (in: lpString1=0x108a7b0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.511] lstrcpyW (in: lpString1=0x108b8c0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.511] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.511] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Wcmsvc%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" [0077.511] PathFindFileNameW (pszPath="Microsoft-Windows-Windows Defender%4Operational.evtx") returned="Microsoft-Windows-Windows Defender%4Operational.evtx" [0077.511] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-windows defender%4operational.evtx") returned="microsoft-windows-windows defender%4operational.evtx" [0077.511] PathFindExtensionW (pszPath="Microsoft-Windows-Windows Defender%4Operational.evtx") returned=".evtx" [0077.511] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.511] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.511] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a660 [0077.511] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a698 [0077.511] LocalAlloc (uFlags=0x40, uBytes=0x110) returned 0x108b9a8 [0077.511] lstrcpyW (in: lpString1=0x108a698, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.511] lstrcpyW (in: lpString1=0x108b9a8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.511] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.511] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Windows Defender%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" [0077.512] PathFindFileNameW (pszPath="Microsoft-Windows-Windows Defender%4WHC.evtx") returned="Microsoft-Windows-Windows Defender%4WHC.evtx" [0077.512] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-windows defender%4whc.evtx") returned="microsoft-windows-windows defender%4whc.evtx" [0077.512] PathFindExtensionW (pszPath="Microsoft-Windows-Windows Defender%4WHC.evtx") returned=".evtx" [0077.512] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.512] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.512] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a708 [0077.512] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a778 [0077.512] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086c68 [0077.512] lstrcpyW (in: lpString1=0x108a778, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.512] lstrcpyW (in: lpString1=0x1086c68, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.512] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.512] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Windows Defender%4WHC.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" [0077.512] PathFindFileNameW (pszPath="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0077.512] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx") returned="microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx" [0077.512] PathFindExtensionW (pszPath="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned=".evtx" [0077.512] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.512] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.512] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108a858 [0077.512] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108add0 [0077.512] LocalAlloc (uFlags=0x40, uBytes=0x180) returned 0x108bac0 [0077.512] lstrcpyW (in: lpString1=0x108add0, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.513] lstrcpyW (in: lpString1=0x108bac0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.513] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.513] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0077.513] PathFindFileNameW (pszPath="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" [0077.513] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-windows firewall with advanced security%4firewall.evtx") returned="microsoft-windows-windows firewall with advanced security%4firewall.evtx" [0077.513] PathFindExtensionW (pszPath="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned=".evtx" [0077.513] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.513] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.513] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ad98 [0077.513] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108ad60 [0077.514] LocalAlloc (uFlags=0x40, uBytes=0x160) returned 0x108bc48 [0077.514] lstrcpyW (in: lpString1=0x108ad60, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.514] lstrcpyW (in: lpString1=0x108bc48, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.514] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.514] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" [0077.514] PathFindFileNameW (pszPath="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" [0077.514] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-wininet-config%4proxyconfigchanged.evtx") returned="microsoft-windows-wininet-config%4proxyconfigchanged.evtx" [0077.514] PathFindExtensionW (pszPath="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned=".evtx" [0077.514] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.514] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.514] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c390 [0077.515] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c160 [0077.515] LocalAlloc (uFlags=0x40, uBytes=0x120) returned 0x108c5b8 [0077.515] lstrcpyW (in: lpString1=0x108c160, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.515] lstrcpyW (in: lpString1=0x108c5b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.515] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.515] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" [0077.515] PathFindFileNameW (pszPath="Microsoft-Windows-Winlogon%4Operational.evtx") returned="Microsoft-Windows-Winlogon%4Operational.evtx" [0077.515] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-winlogon%4operational.evtx") returned="microsoft-windows-winlogon%4operational.evtx" [0077.515] PathFindExtensionW (pszPath="Microsoft-Windows-Winlogon%4Operational.evtx") returned=".evtx" [0077.515] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.515] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.515] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bf30 [0077.515] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108be18 [0077.515] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10860c8 [0077.515] lstrcpyW (in: lpString1=0x108be18, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.515] lstrcpyW (in: lpString1=0x10860c8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.515] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.515] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-Winlogon%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" [0077.516] PathFindFileNameW (pszPath="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="Microsoft-Windows-WMI-Activity%4Operational.evtx" [0077.516] _wcslwr (in: _String=0x2d3f3c4 | out: _String="microsoft-windows-wmi-activity%4operational.evtx") returned="microsoft-windows-wmi-activity%4operational.evtx" [0077.516] PathFindExtensionW (pszPath="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned=".evtx" [0077.516] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.516] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.516] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c128 [0077.516] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c2e8 [0077.516] LocalAlloc (uFlags=0x40, uBytes=0x100) returned 0x1089128 [0077.516] lstrcpyW (in: lpString1=0x108c2e8, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.516] lstrcpyW (in: lpString1=0x1089128, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.516] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.516] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Microsoft-Windows-WMI-Activity%4Operational.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" [0077.516] PathFindFileNameW (pszPath="Security.evtx") returned="Security.evtx" [0077.516] _wcslwr (in: _String=0x2d3f3c4 | out: _String="security.evtx") returned="security.evtx" [0077.516] PathFindExtensionW (pszPath="Security.evtx") returned=".evtx" [0077.516] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.516] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.516] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bfd8 [0077.516] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c048 [0077.516] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x105e8c8 [0077.516] lstrcpyW (in: lpString1=0x108c048, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.516] lstrcpyW (in: lpString1=0x105e8c8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.516] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.517] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Security.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Security.evtx") returned="\\\\?\\C:\\Logs\\Security.evtx" [0077.517] PathFindFileNameW (pszPath="Setup.evtx") returned="Setup.evtx" [0077.517] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setup.evtx") returned="setup.evtx" [0077.517] PathFindExtensionW (pszPath="Setup.evtx") returned=".evtx" [0077.517] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.517] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.517] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c198 [0077.517] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c240 [0077.517] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x105eb98 [0077.517] lstrcpyW (in: lpString1=0x108c240, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.517] lstrcpyW (in: lpString1=0x105eb98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.517] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.517] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Setup.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Setup.evtx") returned="\\\\?\\C:\\Logs\\Setup.evtx" [0077.517] PathFindFileNameW (pszPath="System.evtx") returned="System.evtx" [0077.517] _wcslwr (in: _String=0x2d3f3c4 | out: _String="system.evtx") returned="system.evtx" [0077.517] PathFindExtensionW (pszPath="System.evtx") returned=".evtx" [0077.517] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.517] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.517] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108be50 [0077.517] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c278 [0077.517] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x105e958 [0077.517] lstrcpyW (in: lpString1=0x108c278, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.517] lstrcpyW (in: lpString1=0x105e958, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.517] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.518] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="System.evtx" | out: lpString1="\\\\?\\C:\\Logs\\System.evtx") returned="\\\\?\\C:\\Logs\\System.evtx" [0077.518] PathFindFileNameW (pszPath="Windows PowerShell.evtx") returned="Windows PowerShell.evtx" [0077.518] _wcslwr (in: _String=0x2d3f3c4 | out: _String="windows powershell.evtx") returned="windows powershell.evtx" [0077.518] PathFindExtensionW (pszPath="Windows PowerShell.evtx") returned=".evtx" [0077.518] lstrcatW (in: lpString1="", lpString2="evtx" | out: lpString1="evtx") returned="evtx" [0077.518] _wcslwr (in: _String=0x107b450 | out: _String="evtx") returned="evtx" [0077.518] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c0f0 [0077.518] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c208 [0077.518] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x108c6e0 [0077.518] lstrcpyW (in: lpString1=0x108c208, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0077.518] lstrcpyW (in: lpString1=0x108c6e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.518] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Logs\\" | out: lpString1="\\\\?\\C:\\Logs\\") returned="\\\\?\\C:\\Logs\\" [0077.518] lstrcatW (in: lpString1="\\\\?\\C:\\Logs\\", lpString2="Windows PowerShell.evtx" | out: lpString1="\\\\?\\C:\\Logs\\Windows PowerShell.evtx") returned="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" [0077.518] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.518] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.519] LocalFree (hMem=0x1071818) returned 0x0 [0077.519] NtClose (Handle=0x1b0) returned 0x0 [0077.520] GetProcessHeap () returned 0x1050000 [0077.520] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x107a9e0 | out: hHeap=0x1050000) returned 1 [0077.520] LocalFree (hMem=0x106dcf0) returned 0x0 [0077.520] LocalFree (hMem=0x1071550) returned 0x0 [0077.520] LocalFree (hMem=0x10714f0) returned 0x0 [0077.520] StrCpyNW (in: psz1=0x106f114, psz2="C:\\PerfLogs\\", cchMax=252 | out: psz1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0077.520] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.520] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.520] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.520] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.520] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.520] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.520] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.520] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.520] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.520] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.520] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.520] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.521] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.521] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.521] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.521] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.521] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.521] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.521] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.521] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.521] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.521] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.522] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.522] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.522] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.523] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.523] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.523] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.523] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.523] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.524] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.524] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.525] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.525] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.525] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.525] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.525] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.526] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.526] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.526] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.526] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.526] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.527] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.527] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.527] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.527] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.527] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.528] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.528] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.538] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.538] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.538] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.538] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.538] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.539] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.539] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.539] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.539] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.539] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.539] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.540] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.540] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.540] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.540] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.541] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.541] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.541] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.541] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.541] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.542] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.542] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.542] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.542] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.542] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.543] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.543] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.543] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.543] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.543] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.544] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.544] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.544] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.544] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.544] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.544] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.544] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.544] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.545] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.545] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.545] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.546] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.546] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.546] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.546] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.547] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.547] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.547] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.547] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.548] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.548] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.549] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.549] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.549] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.549] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.549] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.549] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.550] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.550] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.550] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.550] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.551] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.551] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.551] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.551] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.551] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.552] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.552] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.553] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.553] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.553] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.553] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.553] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.554] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.554] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.554] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.554] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.555] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.555] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.555] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.555] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.555] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.555] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.555] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.555] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.555] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.555] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.555] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.555] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.555] LocalFree (hMem=0x106dd98) returned 0x0 [0077.555] LocalFree (hMem=0x1071358) returned 0x0 [0077.555] LocalFree (hMem=0x1071448) returned 0x0 [0077.555] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Program Files\\", cchMax=252 | out: psz1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.555] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.555] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.556] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.556] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.556] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.556] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c3c8 [0077.556] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062128 [0077.556] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108c778 [0077.556] lstrcpyW (in: lpString1=0x1062128, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.556] lstrcpyW (in: lpString1=0x108c778, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.556] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10813b0 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x105e718 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10813c8 [0077.557] PathFindFileNameW (pszPath="desktop.ini") returned="desktop.ini" [0077.557] _wcslwr (in: _String=0x2d3f3c4 | out: _String="desktop.ini") returned="desktop.ini" [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c1d0 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062008 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108c860 [0077.557] lstrcpyW (in: lpString1=0x1062008, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.557] lstrcpyW (in: lpString1=0x108c860, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.557] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.557] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10813f8 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1056700 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081410 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c2b0 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061c60 [0077.557] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d0b0 [0077.558] lstrcpyW (in: lpString1=0x1061c60, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.558] lstrcpyW (in: lpString1=0x108d0b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.558] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.558] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.558] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10814a0 [0077.558] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082b30 [0077.558] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081428 [0077.558] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bf68 [0077.558] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1062248 [0077.558] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d368 [0077.558] lstrcpyW (in: lpString1=0x1062248, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.558] lstrcpyW (in: lpString1=0x108d368, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.559] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081500 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1069420 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081470 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c470 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061b88 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d538 [0077.559] lstrcpyW (in: lpString1=0x1061b88, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.559] lstrcpyW (in: lpString1=0x108d538, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.559] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.559] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081488 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x105ed68 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10814e8 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bef8 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061c18 [0077.559] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d450 [0077.559] lstrcpyW (in: lpString1=0x1061c18, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.559] lstrcpyW (in: lpString1=0x108d450, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.560] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.560] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10814b8 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x108d950 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081518 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c320 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x1061ca8 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108cdf8 [0077.560] lstrcpyW (in: lpString1=0x1061ca8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.560] lstrcpyW (in: lpString1=0x108cdf8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.560] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.560] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10814d0 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082be0 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081368 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bfa0 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e060 [0077.560] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d7f0 [0077.560] lstrcpyW (in: lpString1=0x108e060, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.561] lstrcpyW (in: lpString1=0x108d7f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.561] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080f48 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x108e9c0 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080d80 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c358 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dd48 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108cb40 [0077.561] lstrcpyW (in: lpString1=0x108dd48, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.561] lstrcpyW (in: lpString1=0x108cb40, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.561] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080e40 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082ce8 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080e88 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c080 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108deb0 [0077.561] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108cc28 [0077.561] lstrcpyW (in: lpString1=0x108deb0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.562] lstrcpyW (in: lpString1=0x108cc28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.562] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.562] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080e70 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x108ea38 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080db0 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c438 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108def8 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108c970 [0077.562] lstrcpyW (in: lpString1=0x108def8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.562] lstrcpyW (in: lpString1=0x108c970, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.562] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.562] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080e28 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dd00 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080fc0 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c4a8 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108df40 [0077.562] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d620 [0077.562] lstrcpyW (in: lpString1=0x108df40, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.563] lstrcpyW (in: lpString1=0x108d620, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.563] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080ee8 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x108eab0 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080fd8 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bde0 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108df88 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108cee0 [0077.563] lstrcpyW (in: lpString1=0x108df88, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.563] lstrcpyW (in: lpString1=0x108cee0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.563] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080e58 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x108eb18 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080dc8 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108be88 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e210 [0077.563] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108cd10 [0077.563] lstrcpyW (in: lpString1=0x108e210, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.563] lstrcpyW (in: lpString1=0x108cd10, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.564] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080f60 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x108ebb0 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080d98 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c010 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e1c8 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108ca58 [0077.564] lstrcpyW (in: lpString1=0x108e1c8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.564] lstrcpyW (in: lpString1=0x108ca58, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.564] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080ff0 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x108ec18 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080f78 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c0b8 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e0a8 [0077.564] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108cfc8 [0077.564] lstrcpyW (in: lpString1=0x108e0a8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.564] lstrcpyW (in: lpString1=0x108cfc8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.564] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.564] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.564] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081008 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x108ec90 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081050 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108bec0 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dbe0 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d708 [0077.565] lstrcpyW (in: lpString1=0x108dbe0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.565] lstrcpyW (in: lpString1=0x108d708, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.565] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.565] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080ed0 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082c38 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080fa8 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c4e0 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e138 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d198 [0077.565] lstrcpyW (in: lpString1=0x108e138, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.565] lstrcpyW (in: lpString1=0x108d198, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.565] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.565] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080f00 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x108ed08 [0077.565] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080f90 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c518 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dac0 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108d280 [0077.566] lstrcpyW (in: lpString1=0x108dac0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.566] lstrcpyW (in: lpString1=0x108d280, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.566] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.566] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.566] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080d68 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x108ed80 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081020 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x108c550 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dfd0 [0077.566] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1090870 [0077.567] lstrcpyW (in: lpString1=0x108dfd0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.567] lstrcpyW (in: lpString1=0x1090870, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.567] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.567] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.567] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080f18 [0077.567] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091098 [0077.567] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080ea0 [0077.567] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dd98 [0077.567] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108de68 [0077.567] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1090300 [0077.567] lstrcpyW (in: lpString1=0x108de68, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.567] lstrcpyW (in: lpString1=0x1090300, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.567] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.568] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.568] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080eb8 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091168 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080de0 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x106dcf0 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108db50 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108ff60 [0077.568] lstrcpyW (in: lpString1=0x108db50, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.568] lstrcpyW (in: lpString1=0x108ff60, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.568] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.568] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.568] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080f30 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082d98 [0077.568] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081038 [0077.569] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091ef8 [0077.569] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e0f0 [0077.569] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f738 [0077.569] lstrcpyW (in: lpString1=0x108e0f0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0077.569] lstrcpyW (in: lpString1=0x108f738, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.569] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0077.569] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0077.569] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1080df8 [0077.569] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1090e28 [0077.569] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1080e10 [0077.569] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.570] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.570] LocalFree (hMem=0x1071818) returned 0x0 [0077.570] NtClose (Handle=0x1b0) returned 0x0 [0077.570] GetProcessHeap () returned 0x1050000 [0077.570] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x108c400 | out: hHeap=0x1050000) returned 1 [0077.570] LocalFree (hMem=0x1061e58) returned 0x0 [0077.570] LocalFree (hMem=0x1071508) returned 0x0 [0077.570] LocalFree (hMem=0x1071400) returned 0x0 [0077.570] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Program Files (x86)\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.571] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.571] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.571] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.571] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.571] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.571] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.571] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.571] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.571] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.571] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.571] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.571] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.572] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.572] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.573] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.573] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.573] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.573] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.573] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.573] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.573] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.573] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.573] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.574] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.574] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.574] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.574] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.575] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.575] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.575] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.575] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.575] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.575] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.575] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.575] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.575] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.580] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.580] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.580] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.580] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.580] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.580] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.580] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.580] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.580] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.581] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.581] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.581] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.581] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.582] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.582] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.582] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.582] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.582] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.582] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.583] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.583] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.584] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.584] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.584] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.584] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.584] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.584] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.585] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.586] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.586] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.586] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.586] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.586] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.586] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.587] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.587] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.588] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.588] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.588] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.588] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.588] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.588] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.589] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.589] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.590] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.590] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.590] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.590] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.590] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.590] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.590] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.590] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.590] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.590] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.590] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.590] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.591] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.591] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.591] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.591] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.591] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.591] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.591] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.591] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.592] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.592] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.592] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.592] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.592] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.592] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.593] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.593] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.594] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.594] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.594] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.594] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.594] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.594] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.595] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.595] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.596] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.597] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.597] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.597] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.597] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.597] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.597] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.597] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.597] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.597] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.597] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.597] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.597] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.597] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.597] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.597] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.597] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.597] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.597] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.597] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.597] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.597] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.598] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.598] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.598] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.598] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.598] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.598] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.598] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.598] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.598] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.598] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.598] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.598] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.598] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.598] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.599] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.599] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.599] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.599] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.599] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.599] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.599] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.599] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.600] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.600] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.601] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.601] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.601] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.602] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.602] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.602] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.602] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.602] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.602] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.602] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.602] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.602] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.602] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.602] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.602] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.602] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.602] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.602] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.602] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.603] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.603] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.603] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.603] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.603] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.603] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.603] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.603] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.603] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.603] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.603] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.603] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.603] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.603] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.603] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.603] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.604] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.605] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.605] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.605] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0077.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.605] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0077.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.605] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.605] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.605] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.605] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.606] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.606] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10921d0 [0077.606] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082818 [0077.606] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087330 [0077.606] lstrcpyW (in: lpString1=0x1082818, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.606] lstrcpyW (in: lpString1=0x1087330, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.607] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.607] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10811e8 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082608 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081260 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091de0 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082298 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087428 [0077.607] lstrcpyW (in: lpString1=0x1082298, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.607] lstrcpyW (in: lpString1=0x1087428, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.607] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.607] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10812d8 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1090e90 [0077.607] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081098 [0077.607] PathFindFileNameW (pszPath="desktop.ini") returned="desktop.ini" [0077.607] _wcslwr (in: _String=0x2d3f3c4 | out: _String="desktop.ini") returned="desktop.ini" [0077.607] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091fd8 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082450 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087618 [0077.608] lstrcpyW (in: lpString1=0x1082450, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.608] lstrcpyW (in: lpString1=0x1087618, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.608] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.608] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081188 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091238 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081110 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092278 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082558 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1085ed8 [0077.608] lstrcpyW (in: lpString1=0x1082558, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.608] lstrcpyW (in: lpString1=0x1085ed8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.608] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.608] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081200 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x107d870 [0077.608] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10810f8 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091e18 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10826b8 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086d60 [0077.609] lstrcpyW (in: lpString1=0x10826b8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.609] lstrcpyW (in: lpString1=0x1086d60, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.609] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.609] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081218 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x107d8e8 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081350 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091e50 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082920 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10861c0 [0077.609] lstrcpyW (in: lpString1=0x1082920, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.609] lstrcpyW (in: lpString1=0x10861c0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.609] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.609] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081338 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091100 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10811d0 [0077.609] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10922e8 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082660 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10862b8 [0077.610] lstrcpyW (in: lpString1=0x1082660, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.610] lstrcpyW (in: lpString1=0x10862b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.610] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.610] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.610] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081230 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106ca50 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10810b0 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092010 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1081f80 [0077.610] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087238 [0077.610] lstrcpyW (in: lpString1=0x1081f80, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.610] lstrcpyW (in: lpString1=0x1087238, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.610] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081068 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x10913d8 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081248 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091f68 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082978 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10879f8 [0077.611] lstrcpyW (in: lpString1=0x1082978, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.611] lstrcpyW (in: lpString1=0x10879f8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.611] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.611] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081128 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x107d960 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10811a0 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092358 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10823a0 [0077.611] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087710 [0077.611] lstrcpyW (in: lpString1=0x10823a0, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.611] lstrcpyW (in: lpString1=0x1087710, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.612] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081278 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x107d9d8 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10812f0 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092160 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10823f8 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086e58 [0077.612] lstrcpyW (in: lpString1=0x10823f8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.612] lstrcpyW (in: lpString1=0x1086e58, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.612] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.612] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10811b8 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091308 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081320 [0077.612] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092400 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082030 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087900 [0077.613] lstrcpyW (in: lpString1=0x1082030, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.613] lstrcpyW (in: lpString1=0x1087900, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.613] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.613] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081080 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x107da50 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081140 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091fa0 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082710 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087808 [0077.613] lstrcpyW (in: lpString1=0x1082710, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.613] lstrcpyW (in: lpString1=0x1087808, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.613] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.613] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1081290 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106cf18 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081308 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092048 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10824a8 [0077.613] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1086f50 [0077.614] lstrcpyW (in: lpString1=0x10824a8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.614] lstrcpyW (in: lpString1=0x1086f50, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.614] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10812a8 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x10911d0 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10812c0 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092080 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082088 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10863b0 [0077.614] lstrcpyW (in: lpString1=0x1082088, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.614] lstrcpyW (in: lpString1=0x10863b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.614] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.614] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10810c8 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x1092610 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081158 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10920b8 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082870 [0077.614] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1087048 [0077.614] lstrcpyW (in: lpString1=0x1082870, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.615] lstrcpyW (in: lpString1=0x1087048, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.615] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.615] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10810e0 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106d688 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1081170 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092208 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082500 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x10865a0 [0077.615] lstrcpyW (in: lpString1=0x1082500, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.615] lstrcpyW (in: lpString1=0x10865a0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.615] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.615] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10714d8 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x1092688 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10713d0 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091d38 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10825b0 [0077.615] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x1094150 [0077.616] lstrcpyW (in: lpString1=0x10825b0, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0077.616] lstrcpyW (in: lpString1=0x1094150, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.616] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0077.616] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0077.616] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071550 [0077.616] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x1094988 [0077.616] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10714f0 [0077.616] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.618] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.618] LocalFree (hMem=0x1071818) returned 0x0 [0077.618] NtClose (Handle=0x1b0) returned 0x0 [0077.618] GetProcessHeap () returned 0x1050000 [0077.618] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x106b440 | out: hHeap=0x1050000) returned 1 [0077.618] LocalFree (hMem=0x106e388) returned 0x0 [0077.618] LocalFree (hMem=0x1071460) returned 0x0 [0077.618] LocalFree (hMem=0x1071520) returned 0x0 [0077.618] StrCpyNW (in: psz1=0x106f114, psz2="C:\\ProgramData\\", cchMax=252 | out: psz1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.618] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.618] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.618] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.618] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.618] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.618] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.619] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.619] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.619] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.619] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.620] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.620] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.620] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.620] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.620] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.620] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.621] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.621] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.621] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.621] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.621] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.621] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.621] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.621] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.622] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.622] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.622] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.623] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.623] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.623] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.623] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.623] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.623] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.624] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.624] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.624] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.624] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.625] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.625] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.625] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.626] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.626] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.626] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.626] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.626] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.626] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.627] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.627] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.627] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.627] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.627] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.627] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.628] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.628] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.628] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.629] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.629] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.629] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.629] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.630] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.630] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.630] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.630] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.630] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.630] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.631] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.631] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.631] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.631] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.631] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.631] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.631] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.631] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.631] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.631] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.631] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.631] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.631] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.631] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.631] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.631] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.631] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.631] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.632] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.632] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.632] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.632] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.632] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.633] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.633] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.633] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.633] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.633] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.633] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.633] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.633] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.633] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.633] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.633] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.633] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.633] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.633] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.633] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.633] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.633] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.633] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.634] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.634] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.634] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.634] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.634] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.634] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.635] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.635] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.635] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.635] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.635] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.635] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.636] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.636] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.636] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.636] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.636] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.636] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.636] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.636] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.637] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.637] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.637] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.638] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.639] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.639] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.639] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.639] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.639] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.639] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.640] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.640] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.640] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.641] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.641] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.641] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.641] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.642] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.642] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.643] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.643] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.643] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.643] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10920f0 [0077.643] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e018 [0077.643] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f398 [0077.643] lstrcpyW (in: lpString1=0x108e018, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.643] lstrcpyW (in: lpString1=0x108f398, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.643] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.643] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071358 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108db08 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071508 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092240 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108db98 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f650 [0077.644] lstrcpyW (in: lpString1=0x108db98, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.644] lstrcpyW (in: lpString1=0x108f650, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.644] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.644] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071448 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091370 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071520 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091da8 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e180 [0077.644] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108fad8 [0077.644] lstrcpyW (in: lpString1=0x108e180, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.644] lstrcpyW (in: lpString1=0x108fad8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.644] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.644] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10715f8 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e258 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071610 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092198 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dc28 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108eff8 [0077.645] lstrcpyW (in: lpString1=0x108dc28, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.645] lstrcpyW (in: lpString1=0x108eff8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.645] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.645] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071628 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10822f0 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10713b8 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092128 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dd90 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1090958 [0077.645] lstrcpyW (in: lpString1=0x108dd90, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.645] lstrcpyW (in: lpString1=0x1090958, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.645] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.645] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071400 [0077.645] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1081fd8 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071418 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10922b0 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e2a0 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f1c8 [0077.646] lstrcpyW (in: lpString1=0x108e2a0, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.646] lstrcpyW (in: lpString1=0x108f1c8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.646] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.646] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1071430 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082768 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1071460 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092390 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dc70 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1090a40 [0077.646] lstrcpyW (in: lpString1=0x108dc70, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.646] lstrcpyW (in: lpString1=0x1090a40, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.646] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.646] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095240 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x10912a0 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095438 [0077.646] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091e88 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108ddd8 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f0e0 [0077.647] lstrcpyW (in: lpString1=0x108ddd8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.647] lstrcpyW (in: lpString1=0x108f0e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.647] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.647] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095420 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10829d0 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095348 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092320 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108d9e8 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108fbc0 [0077.647] lstrcpyW (in: lpString1=0x108d9e8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.647] lstrcpyW (in: lpString1=0x108fbc0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.647] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.647] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10953f0 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082190 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095510 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091d70 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108da30 [0077.647] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108ee28 [0077.647] lstrcpyW (in: lpString1=0x108da30, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.647] lstrcpyW (in: lpString1=0x108ee28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.647] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.648] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095450 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x1094730 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095468 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10923c8 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108dcb8 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f820 [0077.648] lstrcpyW (in: lpString1=0x108dcb8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.648] lstrcpyW (in: lpString1=0x108f820, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.648] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.648] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10952d0 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1091440 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095360 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091ec0 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108de20 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f908 [0077.648] lstrcpyW (in: lpString1=0x108de20, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.648] lstrcpyW (in: lpString1=0x108f908, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.648] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.648] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095288 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10827c0 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10953d8 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091f30 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108da78 [0077.648] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108f9f0 [0077.649] lstrcpyW (in: lpString1=0x108da78, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.649] lstrcpyW (in: lpString1=0x108f9f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.649] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.649] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095498 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10828c8 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095408 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092518 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e648 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x10904d0 [0077.649] lstrcpyW (in: lpString1=0x108e648, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.649] lstrcpyW (in: lpString1=0x10904d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.649] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.649] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095480 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082a28 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095330 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10924a8 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e378 [0077.649] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1090048 [0077.649] lstrcpyW (in: lpString1=0x108e378, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.649] lstrcpyW (in: lpString1=0x1090048, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.649] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.649] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.649] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10954f8 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10820e0 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10954b0 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092438 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e408 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x1090788 [0077.650] lstrcpyW (in: lpString1=0x108e408, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0077.650] lstrcpyW (in: lpString1=0x1090788, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.650] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0077.650] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0077.650] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095258 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x1094d48 [0077.650] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10954c8 [0077.650] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.650] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.650] LocalFree (hMem=0x1071818) returned 0x0 [0077.650] NtClose (Handle=0x1b0) returned 0x0 [0077.650] GetProcessHeap () returned 0x1050000 [0077.650] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x1064498 | out: hHeap=0x1050000) returned 1 [0077.651] LocalFree (hMem=0x1061f30) returned 0x0 [0077.651] LocalFree (hMem=0x1071478) returned 0x0 [0077.651] LocalFree (hMem=0x1071538) returned 0x0 [0077.651] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Recovery\\", cchMax=252 | out: psz1="C:\\Recovery\\") returned="C:\\Recovery\\" [0077.651] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.651] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.651] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.651] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.651] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.651] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.651] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.651] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.651] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.652] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.652] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.652] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.652] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.652] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.652] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.652] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.652] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.652] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.652] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.653] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.653] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.653] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.653] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.653] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.653] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.662] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.662] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.662] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.663] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.663] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.663] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.663] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.663] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.663] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.664] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.664] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.664] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.664] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.664] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.664] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.664] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.665] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.665] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.665] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.665] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.665] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.665] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.666] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.666] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.666] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.666] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.666] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.666] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.667] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.667] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.667] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.667] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.667] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.667] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.668] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.668] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.668] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.669] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.669] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.669] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.669] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.670] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.670] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.670] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.670] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.670] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.670] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.671] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.671] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.671] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.671] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.671] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.671] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.672] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.672] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.672] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.673] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.673] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.673] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.673] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.673] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.673] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.673] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.674] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.674] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.674] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.674] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.674] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.674] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.675] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.675] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.675] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.675] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.675] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.675] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.676] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.676] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.676] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.676] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.676] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.676] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.677] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.677] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.677] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.677] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.677] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.677] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.678] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.678] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.678] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.678] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.678] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.678] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.678] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.678] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.678] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.678] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.678] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.679] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.679] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.679] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.679] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.679] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.679] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.680] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.680] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.680] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.680] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.681] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.681] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.681] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.682] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.682] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.682] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.682] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.682] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.682] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.683] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Recovery\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Recovery\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.683] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Recovery\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.684] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.684] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.685] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.685] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10925c0 [0077.685] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092470 [0077.685] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068938 [0077.685] lstrcpyW (in: lpString1=0x1092470, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0077.685] lstrcpyW (in: lpString1=0x1068938, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.685] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Recovery\\" | out: lpString1="\\\\?\\C:\\Recovery\\") returned="\\\\?\\C:\\Recovery\\" [0077.685] lstrcatW (in: lpString1="\\\\?\\C:\\Recovery\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Recovery\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Recovery\\!!_FILES_ENCRYPTED_.txt" [0077.685] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095528 [0077.685] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e450 [0077.685] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10952e8 [0077.685] PathFindFileNameW (pszPath="ReAgentOld.xml") returned="ReAgentOld.xml" [0077.685] _wcslwr (in: _String=0x2d3f3c4 | out: _String="reagentold.xml") returned="reagentold.xml" [0077.686] PathFindExtensionW (pszPath="ReAgentOld.xml") returned=".xml" [0077.686] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0077.686] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0077.686] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092550 [0077.686] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1092588 [0077.686] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106d578 [0077.686] lstrcpyW (in: lpString1=0x1092588, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0077.686] lstrcpyW (in: lpString1=0x106d578, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.686] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Recovery\\" | out: lpString1="\\\\?\\C:\\Recovery\\") returned="\\\\?\\C:\\Recovery\\" [0077.686] lstrcatW (in: lpString1="\\\\?\\C:\\Recovery\\", lpString2="ReAgentOld.xml" | out: lpString1="\\\\?\\C:\\Recovery\\ReAgentOld.xml") returned="\\\\?\\C:\\Recovery\\ReAgentOld.xml" [0077.686] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.686] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.686] LocalFree (hMem=0x1071818) returned 0x0 [0077.686] NtClose (Handle=0x1b0) returned 0x0 [0077.687] GetProcessHeap () returned 0x1050000 [0077.687] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x1064588 | out: hHeap=0x1050000) returned 1 [0077.687] LocalFree (hMem=0x106e038) returned 0x0 [0077.687] LocalFree (hMem=0x10714a8) returned 0x0 [0077.687] LocalFree (hMem=0x10715c8) returned 0x0 [0077.687] StrCpyNW (in: psz1=0x106f114, psz2="C:\\System Volume Information\\", cchMax=252 | out: psz1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0077.687] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.687] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.687] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.687] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.687] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.687] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.687] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.687] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.687] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.687] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.687] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.687] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.688] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.689] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.689] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.689] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.690] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.690] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.690] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.690] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.690] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.690] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.691] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.692] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.692] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.692] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.693] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.694] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.694] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.694] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.694] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.695] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.695] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.695] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.696] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.697] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.697] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.697] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.697] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.697] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.698] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.700] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.700] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.700] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.700] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.704] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.704] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.704] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.704] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.705] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.705] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.705] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.705] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.705] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.705] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.706] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.707] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.708] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.708] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.708] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.708] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.708] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.708] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.709] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.709] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.709] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.709] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.709] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.709] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.709] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.709] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.709] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.709] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.709] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.710] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.710] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.710] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.710] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.710] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.710] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.710] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.710] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.710] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.710] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.710] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.710] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.711] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.711] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.712] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.712] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.712] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.712] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.712] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.712] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.712] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.712] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.712] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.712] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.712] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.712] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.713] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.713] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.713] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.713] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.714] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.714] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.714] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.714] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.714] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.714] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.714] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.714] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.714] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.714] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.715] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.715] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.715] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.715] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.715] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.715] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.715] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.715] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.715] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.716] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.716] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.716] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.716] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.716] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.716] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.716] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.716] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.716] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0077.717] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.717] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.718] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.718] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.719] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.719] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.719] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.720] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.720] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.720] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.720] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.721] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.721] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.721] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.721] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0077.721] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.721] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.721] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0077.722] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.722] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.722] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.722] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0077.722] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.722] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.722] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.722] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0077.722] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.722] LocalFree (hMem=0x106e228) returned 0x0 [0077.722] LocalFree (hMem=0x1071568) returned 0x0 [0077.722] LocalFree (hMem=0x1071580) returned 0x0 [0077.722] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Users\\", cchMax=252 | out: psz1="C:\\Users\\") returned="C:\\Users\\" [0077.723] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.723] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.723] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.723] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.724] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.724] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10924e0 [0077.724] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091be8 [0077.724] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068278 [0077.724] lstrcpyW (in: lpString1=0x1091be8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0077.724] lstrcpyW (in: lpString1=0x1068278, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.724] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0077.724] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0077.724] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10954e0 [0077.724] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e768 [0077.724] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095300 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10916e0 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091b40 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068c98 [0077.725] lstrcpyW (in: lpString1=0x1091b40, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0077.725] lstrcpyW (in: lpString1=0x1068c98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.725] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0077.725] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0077.725] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095270 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e498 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10952a0 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091718 [0077.725] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091ad0 [0077.726] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1067ff0 [0077.726] lstrcpyW (in: lpString1=0x1091ad0, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0077.726] lstrcpyW (in: lpString1=0x1067ff0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.726] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0077.726] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0077.726] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10952b8 [0077.726] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082138 [0077.726] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095318 [0077.726] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10918a0 [0077.726] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091868 [0077.726] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068500 [0077.726] lstrcpyW (in: lpString1=0x1091868, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0077.727] lstrcpyW (in: lpString1=0x1068500, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.727] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0077.727] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0077.727] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10953c0 [0077.727] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x10821e8 [0077.727] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095378 [0077.727] PathFindFileNameW (pszPath="desktop.ini") returned="desktop.ini" [0077.727] _wcslwr (in: _String=0x2d3f3c4 | out: _String="desktop.ini") returned="desktop.ini" [0077.727] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091910 [0077.727] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091638 [0077.727] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068bc0 [0077.727] lstrcpyW (in: lpString1=0x1091638, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0077.728] lstrcpyW (in: lpString1=0x1068bc0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.728] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0077.728] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0077.728] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1095390 [0077.728] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e3c0 [0077.728] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x10953a8 [0077.728] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091c20 [0077.728] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091d00 [0077.728] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1067a08 [0077.728] lstrcpyW (in: lpString1=0x1091d00, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0077.728] lstrcpyW (in: lpString1=0x1067a08, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.728] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0077.728] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0077.729] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x10956d8 [0077.729] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e4e0 [0077.729] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1095690 [0077.729] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.729] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.729] LocalFree (hMem=0x1071818) returned 0x0 [0077.729] NtClose (Handle=0x1b0) returned 0x0 [0077.729] GetProcessHeap () returned 0x1050000 [0077.730] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x107ac88 | out: hHeap=0x1050000) returned 1 [0077.730] LocalFree (hMem=0x107c3a0) returned 0x0 [0077.730] LocalFree (hMem=0x1071598) returned 0x0 [0077.730] LocalFree (hMem=0x1071370) returned 0x0 [0077.730] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Windows\\", cchMax=252 | out: psz1="C:\\Windows\\") returned="C:\\Windows\\" [0077.730] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.730] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.730] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.730] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.730] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.730] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.730] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.730] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.730] RtlUpcaseUnicodeChar (Source=0x57) returned 0x57 [0077.730] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.730] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.730] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.730] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.730] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.730] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.730] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.730] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.731] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.731] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.731] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.731] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.731] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.731] LocalFree (hMem=0x107c368) returned 0x0 [0077.731] LocalFree (hMem=0x10715b0) returned 0x0 [0077.731] LocalFree (hMem=0x10715e0) returned 0x0 [0077.731] StrCpyNW (in: psz1=0x106f114, psz2="C:\\Windows10Upgrade\\", cchMax=252 | out: psz1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0077.731] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.731] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.731] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.731] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.732] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.732] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.732] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.732] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.732] RtlUpcaseUnicodeChar (Source=0x57) returned 0x57 [0077.732] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.732] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.732] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.732] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.732] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.732] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.732] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.732] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.732] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.732] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.732] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.732] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.732] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.732] LocalFree (hMem=0x10621b8) returned 0x0 [0077.733] LocalFree (hMem=0x1071340) returned 0x0 [0077.733] LocalFree (hMem=0x10717d8) returned 0x0 [0077.733] StrCpyNW (in: psz1=0x106f114, psz2="C:\\$GetCurrent\\Logs\\", cchMax=252 | out: psz1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0077.733] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.733] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.733] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.733] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.733] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.733] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.733] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.733] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.733] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.733] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.733] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.733] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.733] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.733] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.734] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.734] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.734] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.734] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.735] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.735] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.736] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.736] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.736] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.736] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.736] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.736] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.736] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.736] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.736] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.736] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.736] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.736] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.736] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.737] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.737] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.737] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.737] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.737] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.737] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.737] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.737] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.737] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.737] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.737] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.737] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.737] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.737] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.737] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.738] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.738] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.739] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.739] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.739] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.739] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.739] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.740] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.740] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.740] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.740] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.741] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.741] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.741] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.741] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.741] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.741] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.742] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.743] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.743] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.743] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.743] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.743] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.743] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.744] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.744] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.744] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.744] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.745] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.745] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.745] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.745] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.746] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.746] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.746] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.747] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.747] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.747] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.747] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.755] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.755] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.755] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.755] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.756] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.756] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.756] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.756] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.757] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.757] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.757] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.758] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.758] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.758] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.758] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.759] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.760] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.760] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.760] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.761] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.761] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.761] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.761] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.761] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.761] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.762] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.762] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.762] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.762] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.762] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.762] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.762] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.762] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.762] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.762] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.762] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.763] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.763] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.763] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.763] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.763] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.763] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.763] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.763] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.764] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.764] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.764] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.765] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.765] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.765] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.766] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.766] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.766] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.766] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.766] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.766] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.766] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.766] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.766] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.766] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.766] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.766] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.766] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.766] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.767] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.767] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.767] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.768] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.769] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.769] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.769] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.769] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.769] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.769] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.769] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.770] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.770] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.770] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.770] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.770] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.770] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.770] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.771] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.771] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.771] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.771] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.772] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.772] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.772] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.773] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.773] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.773] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.773] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.774] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.774] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.774] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.774] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.775] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.775] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.775] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.776] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.776] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.776] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.776] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.777] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.777] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.777] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.777] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.778] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.778] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.778] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.778] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0077.778] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.778] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.822] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.822] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.822] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.822] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.822] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.822] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.822] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\$GetCurrent\\Logs\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\$GetCurrent\\Logs\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.822] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\$GetCurrent\\Logs\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.825] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.825] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.826] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.827] PathFindFileNameW (pszPath="downlevel_2017_09_07_02_02_39_766.log") returned="downlevel_2017_09_07_02_02_39_766.log" [0077.827] _wcslwr (in: _String=0x2d3f3c4 | out: _String="downlevel_2017_09_07_02_02_39_766.log") returned="downlevel_2017_09_07_02_02_39_766.log" [0077.827] PathFindExtensionW (pszPath="downlevel_2017_09_07_02_02_39_766.log") returned=".log" [0077.827] lstrcatW (in: lpString1="", lpString2="log" | out: lpString1="log") returned="log" [0077.827] _wcslwr (in: _String=0x107b450 | out: _String="log") returned="log" [0077.828] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091bb0 [0077.828] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e330 [0077.828] LocalAlloc (uFlags=0x40, uBytes=0xe0) returned 0x108ef10 [0077.828] lstrcpyW (in: lpString1=0x108e330, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0077.828] lstrcpyW (in: lpString1=0x108ef10, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.828] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\") returned="\\\\?\\C:\\$GetCurrent\\Logs\\" [0077.828] lstrcatW (in: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\", lpString2="downlevel_2017_09_07_02_02_39_766.log" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" [0077.828] PathFindFileNameW (pszPath="oobe_2017_09_07_03_08_57_737.log") returned="oobe_2017_09_07_03_08_57_737.log" [0077.828] _wcslwr (in: _String=0x2d3f3c4 | out: _String="oobe_2017_09_07_03_08_57_737.log") returned="oobe_2017_09_07_03_08_57_737.log" [0077.828] PathFindExtensionW (pszPath="oobe_2017_09_07_03_08_57_737.log") returned=".log" [0077.828] lstrcatW (in: lpString1="", lpString2="log" | out: lpString1="log") returned="log" [0077.828] _wcslwr (in: _String=0x107b450 | out: _String="log") returned="log" [0077.828] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091cc8 [0077.829] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e7b0 [0077.829] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068a10 [0077.829] lstrcpyW (in: lpString1=0x108e7b0, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0077.829] lstrcpyW (in: lpString1=0x1068a10, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.829] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\") returned="\\\\?\\C:\\$GetCurrent\\Logs\\" [0077.829] lstrcatW (in: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\", lpString2="oobe_2017_09_07_03_08_57_737.log" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" [0077.829] PathFindFileNameW (pszPath="PartnerSetupCompleteResult.log") returned="PartnerSetupCompleteResult.log" [0077.829] _wcslwr (in: _String=0x2d3f3c4 | out: _String="partnersetupcompleteresult.log") returned="partnersetupcompleteresult.log" [0077.829] PathFindExtensionW (pszPath="PartnerSetupCompleteResult.log") returned=".log" [0077.829] lstrcatW (in: lpString1="", lpString2="log" | out: lpString1="log") returned="log" [0077.829] _wcslwr (in: _String=0x107b450 | out: _String="log") returned="log" [0077.829] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091b78 [0077.829] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x108e690 [0077.829] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1068350 [0077.829] lstrcpyW (in: lpString1=0x108e690, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0077.830] lstrcpyW (in: lpString1=0x1068350, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.830] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\") returned="\\\\?\\C:\\$GetCurrent\\Logs\\" [0077.830] lstrcatW (in: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\", lpString2="PartnerSetupCompleteResult.log" | out: lpString1="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0077.830] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.830] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.830] LocalFree (hMem=0x1071818) returned 0x0 [0077.830] NtClose (Handle=0x1b0) returned 0x0 [0077.831] GetProcessHeap () returned 0x1050000 [0077.832] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x106af40 | out: hHeap=0x1050000) returned 1 [0077.832] LocalFree (hMem=0x1061fc0) returned 0x0 [0077.832] LocalFree (hMem=0x10713e8) returned 0x0 [0077.832] LocalFree (hMem=0x1071718) returned 0x0 [0077.832] StrCpyNW (in: psz1=0x106f114, psz2="C:\\$GetCurrent\\SafeOS\\", cchMax=252 | out: psz1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0077.832] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.832] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.832] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.832] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.832] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.832] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.832] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.832] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.832] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.832] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.832] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.832] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.832] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.832] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.833] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.833] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.833] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.833] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.834] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.834] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.835] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.835] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.835] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.835] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.835] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.835] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.835] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.835] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.835] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.835] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.835] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.835] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.835] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.835] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.836] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.836] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.836] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.836] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.836] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.836] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.836] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.836] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.836] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.836] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.837] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.837] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.837] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.837] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.837] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.837] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.837] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.837] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.837] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.837] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.837] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.837] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.838] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.838] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.838] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.838] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.838] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.838] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.838] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.839] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.839] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.839] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.839] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.839] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.839] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.840] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.840] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.840] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.840] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.841] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.844] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.845] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.845] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.845] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.846] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.846] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.846] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.846] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.846] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.846] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.846] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.846] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.847] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.848] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.848] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.848] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.848] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.848] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.848] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.848] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.848] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.848] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.848] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.848] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.848] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.848] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.849] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.849] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.849] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.850] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.850] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.850] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.850] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.851] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.851] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.851] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.851] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.852] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.852] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.852] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.852] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.853] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.853] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.853] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.853] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.854] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.854] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.854] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.854] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.854] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.854] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.854] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.854] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.854] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.854] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.854] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.854] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.855] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.855] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.855] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.855] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.856] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.856] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.856] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.856] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.856] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.856] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.856] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.856] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.856] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.859] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.859] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.859] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.859] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.859] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.859] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.859] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.860] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.860] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.860] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.860] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.860] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.862] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.863] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.863] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.863] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.863] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.863] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.863] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.863] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.863] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.863] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.863] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.863] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.863] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.864] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.864] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.864] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.864] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.864] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.864] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.864] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.864] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.864] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.865] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.865] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.865] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.865] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.865] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.865] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.865] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.865] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.865] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0077.865] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.865] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.866] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.866] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.866] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.866] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.866] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.866] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.866] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.866] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.866] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.866] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.866] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.867] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.867] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.867] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.867] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.867] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.868] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.868] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.868] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.868] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.868] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.869] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.869] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.869] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.869] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.869] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.869] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.869] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.869] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.869] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.869] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.869] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.869] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.870] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.870] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.870] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.870] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.871] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.871] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.871] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.871] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.872] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.872] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.872] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.872] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.872] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.872] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.872] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.872] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.872] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.872] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.873] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.873] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.874] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.874] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.874] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.874] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.875] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.875] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.875] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.876] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.876] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.876] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.876] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.877] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.877] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.877] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.878] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.878] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.878] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.878] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.879] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.879] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.879] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.879] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.879] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.879] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.879] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.879] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.879] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0077.880] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.880] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.881] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.881] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.881] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.882] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.882] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.882] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.882] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.882] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.882] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.882] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0077.882] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.882] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.882] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.883] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.883] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.883] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.883] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0077.883] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.884] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.884] RtlUpcaseUnicodeChar (Source=0x47) returned 0x47 [0077.884] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.884] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.884] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.884] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0077.884] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.884] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\$GetCurrent\\SafeOS\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\$GetCurrent\\SafeOS\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.884] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\$GetCurrent\\SafeOS\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.889] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.889] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.893] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.893] PathFindFileNameW (pszPath="GetCurrentOOBE.dll") returned="GetCurrentOOBE.dll" [0077.893] _wcslwr (in: _String=0x2d3f3c4 | out: _String="getcurrentoobe.dll") returned="getcurrentoobe.dll" [0077.893] PathFindExtensionW (pszPath="GetCurrentOOBE.dll") returned=".dll" [0077.893] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0077.893] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0077.893] PathFindFileNameW (pszPath="GetCurrentRollback.ini") returned="GetCurrentRollback.ini" [0077.894] _wcslwr (in: _String=0x2d3f3c4 | out: _String="getcurrentrollback.ini") returned="getcurrentrollback.ini" [0077.894] PathFindExtensionW (pszPath="GetCurrentRollback.ini") returned=".ini" [0077.894] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0077.894] _wcslwr (in: _String=0x107b450 | out: _String="ini") returned="ini" [0077.894] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091750 [0077.894] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082348 [0077.894] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x1095718 [0077.894] lstrcpyW (in: lpString1=0x1082348, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0077.894] lstrcpyW (in: lpString1=0x1095718, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.895] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="\\\\?\\C:\\$GetCurrent\\SafeOS\\") returned="\\\\?\\C:\\$GetCurrent\\SafeOS\\" [0077.895] lstrcatW (in: lpString1="\\\\?\\C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentRollback.ini" | out: lpString1="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0077.895] PathFindFileNameW (pszPath="PartnerSetupComplete.cmd") returned="PartnerSetupComplete.cmd" [0077.895] _wcslwr (in: _String=0x2d3f3c4 | out: _String="partnersetupcomplete.cmd") returned="partnersetupcomplete.cmd" [0077.895] PathFindExtensionW (pszPath="PartnerSetupComplete.cmd") returned=".cmd" [0077.895] lstrcatW (in: lpString1="", lpString2="cmd" | out: lpString1="cmd") returned="cmd" [0077.895] _wcslwr (in: _String=0x107b450 | out: _String="cmd") returned="cmd" [0077.895] PathFindFileNameW (pszPath="preoobe.cmd") returned="preoobe.cmd" [0077.895] _wcslwr (in: _String=0x2d3f3c4 | out: _String="preoobe.cmd") returned="preoobe.cmd" [0077.895] PathFindExtensionW (pszPath="preoobe.cmd") returned=".cmd" [0077.896] lstrcatW (in: lpString1="", lpString2="cmd" | out: lpString1="cmd") returned="cmd" [0077.896] _wcslwr (in: _String=0x107b450 | out: _String="cmd") returned="cmd" [0077.896] PathFindFileNameW (pszPath="SetupComplete.cmd") returned="SetupComplete.cmd" [0077.896] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupcomplete.cmd") returned="setupcomplete.cmd" [0077.896] PathFindExtensionW (pszPath="SetupComplete.cmd") returned=".cmd" [0077.896] lstrcatW (in: lpString1="", lpString2="cmd" | out: lpString1="cmd") returned="cmd" [0077.896] _wcslwr (in: _String=0x107b450 | out: _String="cmd") returned="cmd" [0077.896] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.897] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.897] LocalFree (hMem=0x1071818) returned 0x0 [0077.897] NtClose (Handle=0x1b0) returned 0x0 [0077.899] GetProcessHeap () returned 0x1050000 [0077.899] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x106b200 | out: hHeap=0x1050000) returned 1 [0077.899] LocalFree (hMem=0x106e6a0) returned 0x0 [0077.899] LocalFree (hMem=0x10716b8) returned 0x0 [0077.899] LocalFree (hMem=0x1071748) returned 0x0 [0077.900] StrCpyNW (in: psz1=0x106f114, psz2="C:\\588bce7c90097ed212\\1025\\", cchMax=252 | out: psz1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0077.900] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.900] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.900] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.900] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.900] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.900] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.900] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.900] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.900] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.900] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.901] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.901] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.901] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.901] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.901] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.901] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.901] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.901] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.901] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.901] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.901] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.901] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.902] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.902] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.902] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.903] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.903] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.903] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.903] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.903] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.903] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.903] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.903] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.904] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.904] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.905] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.905] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.905] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.905] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.905] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.905] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.905] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.905] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.905] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.905] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.905] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.905] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.905] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.905] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.905] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.905] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.905] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.905] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.905] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.906] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.906] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.907] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.907] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.908] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.908] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.908] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.908] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.908] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.908] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.908] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.908] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.908] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.908] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.908] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.909] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.909] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.910] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.910] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.910] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.911] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.911] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.911] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.911] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.911] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.911] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.912] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.912] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.913] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.913] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.913] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.914] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.914] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.914] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.915] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.915] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.915] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.915] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.916] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.916] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.917] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.917] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.917] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.918] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.918] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.918] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.918] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.918] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.918] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.919] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.919] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.919] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.919] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.919] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.919] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.919] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.920] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.920] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.921] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.921] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.921] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.921] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.922] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.922] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.922] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.922] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.922] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.923] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.923] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.924] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.925] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.925] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.925] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.926] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.926] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.926] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.926] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.926] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.926] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.927] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.927] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.927] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.927] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.927] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.927] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.927] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.928] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.929] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.929] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.929] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.929] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.929] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.929] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.930] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.930] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.930] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.930] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.931] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.932] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.932] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.932] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.932] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.932] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.933] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.933] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.933] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.933] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.933] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.933] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\1025\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\1025\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.933] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\588bce7c90097ed212\\1025\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.937] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.938] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.938] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.938] PathFindFileNameW (pszPath="eula.rtf") returned="eula.rtf" [0077.938] _wcslwr (in: _String=0x2d3f3c4 | out: _String="eula.rtf") returned="eula.rtf" [0077.938] PathFindExtensionW (pszPath="eula.rtf") returned=".rtf" [0077.938] lstrcatW (in: lpString1="", lpString2="rtf" | out: lpString1="rtf") returned="rtf" [0077.938] _wcslwr (in: _String=0x107b450 | out: _String="rtf") returned="rtf" [0077.938] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091c58 [0077.938] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1082240 [0077.938] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106cad8 [0077.939] lstrcpyW (in: lpString1=0x1082240, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0077.939] lstrcpyW (in: lpString1=0x106cad8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.939] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1025\\" [0077.939] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025\\", lpString2="eula.rtf" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" [0077.939] PathFindFileNameW (pszPath="LocalizedData.xml") returned="LocalizedData.xml" [0077.939] _wcslwr (in: _String=0x2d3f3c4 | out: _String="localizeddata.xml") returned="localizeddata.xml" [0077.939] PathFindExtensionW (pszPath="LocalizedData.xml") returned=".xml" [0077.939] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0077.939] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10918d8 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e6a0 [0077.939] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x10957d0 [0077.939] lstrcpyW (in: lpString1=0x106e6a0, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0077.939] lstrcpyW (in: lpString1=0x10957d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.939] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1025\\" [0077.939] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025\\", lpString2="LocalizedData.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" [0077.939] PathFindFileNameW (pszPath="SetupResources.dll") returned="SetupResources.dll" [0077.939] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupresources.dll") returned="setupresources.dll" [0077.940] PathFindExtensionW (pszPath="SetupResources.dll") returned=".dll" [0077.940] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0077.940] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0077.940] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.940] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.940] LocalFree (hMem=0x1071818) returned 0x0 [0077.940] NtClose (Handle=0x1b0) returned 0x0 [0077.940] GetProcessHeap () returned 0x1050000 [0077.940] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x108e7f8 | out: hHeap=0x1050000) returned 1 [0077.940] LocalFree (hMem=0x106e648) returned 0x0 [0077.940] LocalFree (hMem=0x1071388) returned 0x0 [0077.940] LocalFree (hMem=0x10713a0) returned 0x0 [0077.941] StrCpyNW (in: psz1=0x106f114, psz2="C:\\588bce7c90097ed212\\1028\\", cchMax=252 | out: psz1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0077.941] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.941] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.941] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.941] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.941] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.941] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.941] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.941] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.942] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.942] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.942] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.942] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.942] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.942] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.943] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.943] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.944] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.944] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.944] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.944] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.944] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.944] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.944] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.944] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.945] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.945] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.945] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.945] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.945] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.945] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.945] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.945] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.945] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.945] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.945] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.946] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.946] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.947] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.947] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.947] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.947] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.947] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.947] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.947] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.947] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.947] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.948] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.948] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.949] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.949] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.949] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.949] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.950] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.950] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.950] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.951] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.951] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.951] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.951] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.952] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.952] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.952] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.952] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.953] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.953] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.953] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.953] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.954] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.954] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.954] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.955] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.955] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.955] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.955] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.956] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.956] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.956] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.957] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.957] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.957] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.957] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.958] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.958] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.959] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.959] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.959] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.959] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.960] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.960] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.960] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.960] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.961] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.961] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.961] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.962] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.963] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.963] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.963] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.963] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0077.964] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.964] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.964] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.964] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.964] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.965] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.965] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.966] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.966] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.966] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.967] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.967] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.967] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.967] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.968] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.968] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.968] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.969] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.969] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.969] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.969] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.970] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.970] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.971] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.971] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.971] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.972] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.972] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.972] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0077.972] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.972] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.972] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.973] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\1028\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\1028\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0077.973] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\588bce7c90097ed212\\1028\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0077.977] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0077.977] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.977] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.978] PathFindFileNameW (pszPath="eula.rtf") returned="eula.rtf" [0077.978] _wcslwr (in: _String=0x2d3f3c4 | out: _String="eula.rtf") returned="eula.rtf" [0077.978] PathFindExtensionW (pszPath="eula.rtf") returned=".rtf" [0077.978] lstrcatW (in: lpString1="", lpString2="rtf" | out: lpString1="rtf") returned="rtf" [0077.978] _wcslwr (in: _String=0x107b450 | out: _String="rtf") returned="rtf" [0077.978] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091948 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e648 [0077.978] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106cc70 [0077.978] lstrcpyW (in: lpString1=0x106e648, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0077.978] lstrcpyW (in: lpString1=0x106cc70, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.978] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1028\\" [0077.978] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028\\", lpString2="eula.rtf" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" [0077.979] PathFindFileNameW (pszPath="LocalizedData.xml") returned="LocalizedData.xml" [0077.979] _wcslwr (in: _String=0x2d3f3c4 | out: _String="localizeddata.xml") returned="localizeddata.xml" [0077.979] PathFindExtensionW (pszPath="LocalizedData.xml") returned=".xml" [0077.979] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0077.979] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0077.979] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091c90 [0077.979] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e6f8 [0077.979] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1095878 [0077.979] lstrcpyW (in: lpString1=0x106e6f8, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0077.979] lstrcpyW (in: lpString1=0x1095878, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0077.979] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1028\\" [0077.979] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028\\", lpString2="LocalizedData.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" [0077.979] PathFindFileNameW (pszPath="SetupResources.dll") returned="SetupResources.dll" [0077.979] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupresources.dll") returned="setupresources.dll" [0077.979] PathFindExtensionW (pszPath="SetupResources.dll") returned=".dll" [0077.979] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0077.979] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0077.979] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0077.980] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0077.980] LocalFree (hMem=0x1071818) returned 0x0 [0077.980] NtClose (Handle=0x1b0) returned 0x0 [0077.980] GetProcessHeap () returned 0x1050000 [0077.980] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x108e840 | out: hHeap=0x1050000) returned 1 [0077.980] LocalFree (hMem=0x106e178) returned 0x0 [0077.980] LocalFree (hMem=0x1071490) returned 0x0 [0077.980] LocalFree (hMem=0x10714c0) returned 0x0 [0077.980] StrCpyNW (in: psz1=0x106f114, psz2="C:\\588bce7c90097ed212\\1029\\", cchMax=252 | out: psz1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0077.980] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.980] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.980] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.980] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.980] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.981] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.981] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.981] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.981] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.981] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.981] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.981] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.981] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.981] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.981] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.981] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.981] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.981] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.981] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.981] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.981] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.981] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.982] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.982] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.982] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.982] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.982] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.982] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.983] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.983] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.983] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.983] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.983] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.983] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.983] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.983] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.983] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.983] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0077.983] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.983] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.984] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.984] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.985] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.985] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.986] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.986] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.986] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.986] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.987] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.987] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.988] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.988] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.988] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.989] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.989] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.989] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.989] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.989] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.989] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.990] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.990] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.991] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.991] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.991] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.991] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.992] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.992] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.992] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.992] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.992] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.992] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.993] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.993] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.994] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.995] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.995] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.995] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0077.995] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.995] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0077.995] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.996] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.996] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.996] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.996] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.997] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.997] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.997] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.997] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0077.997] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.997] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.997] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.997] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.997] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.997] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.998] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.998] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0077.999] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.999] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.999] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.999] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0077.999] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.000] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.000] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.000] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.000] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.000] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.001] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.001] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.001] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.001] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.001] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.001] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.002] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.002] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.002] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.002] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.003] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.003] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.003] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.003] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.003] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.004] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.004] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.004] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.004] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.005] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.005] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.005] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.005] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.005] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.005] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.006] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.006] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.007] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.007] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.007] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.007] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.007] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.008] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.008] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.008] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.008] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.009] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.009] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.009] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.009] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.010] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.010] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.010] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0078.010] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.010] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.010] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\1029\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\1029\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.011] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\588bce7c90097ed212\\1029\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0078.018] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0078.018] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0078.018] PathFindFileNameW (pszPath="eula.rtf") returned="eula.rtf" [0078.018] _wcslwr (in: _String=0x2d3f3c4 | out: _String="eula.rtf") returned="eula.rtf" [0078.018] PathFindExtensionW (pszPath="eula.rtf") returned=".rtf" [0078.018] lstrcatW (in: lpString1="", lpString2="rtf" | out: lpString1="rtf") returned="rtf" [0078.018] _wcslwr (in: _String=0x107b450 | out: _String="rtf") returned="rtf" [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10919f0 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e388 [0078.018] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106cb60 [0078.018] lstrcpyW (in: lpString1=0x106e388, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0078.019] lstrcpyW (in: lpString1=0x106cb60, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0078.019] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1029\\" [0078.019] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029\\", lpString2="eula.rtf" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" [0078.019] PathFindFileNameW (pszPath="LocalizedData.xml") returned="LocalizedData.xml" [0078.019] _wcslwr (in: _String=0x2d3f3c4 | out: _String="localizeddata.xml") returned="localizeddata.xml" [0078.019] PathFindExtensionW (pszPath="LocalizedData.xml") returned=".xml" [0078.019] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0078.019] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0078.019] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091b08 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e800 [0078.019] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1095920 [0078.019] lstrcpyW (in: lpString1=0x106e800, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0078.019] lstrcpyW (in: lpString1=0x1095920, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0078.019] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1029\\" [0078.019] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029\\", lpString2="LocalizedData.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" [0078.019] PathFindFileNameW (pszPath="SetupResources.dll") returned="SetupResources.dll" [0078.019] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupresources.dll") returned="setupresources.dll" [0078.019] PathFindExtensionW (pszPath="SetupResources.dll") returned=".dll" [0078.019] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0078.019] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0078.019] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0078.020] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0078.020] LocalFree (hMem=0x1071818) returned 0x0 [0078.020] NtClose (Handle=0x1b0) returned 0x0 [0078.020] GetProcessHeap () returned 0x1050000 [0078.020] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x108e528 | out: hHeap=0x1050000) returned 1 [0078.020] LocalFree (hMem=0x106e4e8) returned 0x0 [0078.020] LocalFree (hMem=0x10717c0) returned 0x0 [0078.020] LocalFree (hMem=0x10716d0) returned 0x0 [0078.020] StrCpyNW (in: psz1=0x106f114, psz2="C:\\588bce7c90097ed212\\1030\\", cchMax=252 | out: psz1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0078.020] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.020] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.020] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.020] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.020] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.020] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.021] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.021] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.021] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.021] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.021] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.021] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.021] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.021] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.022] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.022] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.022] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.022] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.023] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.023] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.023] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.023] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.023] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.023] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.023] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.023] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.023] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0078.023] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.023] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.023] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.024] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.024] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.025] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.025] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.025] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.025] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.025] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.026] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.026] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.026] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.026] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.027] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.027] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.027] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.028] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.028] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.028] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.028] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.028] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.028] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.028] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.028] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.028] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.028] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.029] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.029] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.029] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.029] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.029] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.029] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.030] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.030] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.031] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.032] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.032] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.032] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.032] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.032] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.032] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.033] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.033] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.033] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.033] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.034] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.034] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.035] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.035] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.035] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.035] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.035] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.035] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.036] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.036] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.036] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.036] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.036] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.037] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.037] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.038] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.038] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.038] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.038] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.038] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.038] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.038] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.038] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.038] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.038] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.038] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.038] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.039] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.039] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.039] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.039] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.039] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.039] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.039] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.039] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.040] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.040] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.040] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.040] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.040] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.040] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.041] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.041] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.041] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.041] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.042] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.042] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.043] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.043] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.043] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.043] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.044] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.044] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.045] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.045] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.045] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.045] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.045] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.046] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.046] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.047] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.048] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.048] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.048] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.048] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.048] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.048] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.049] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.049] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.049] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.049] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.049] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.049] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.049] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.049] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.050] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.050] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.050] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.050] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.050] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.050] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.050] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.050] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.050] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.050] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.050] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.051] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.051] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.052] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.052] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.052] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.052] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.053] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.053] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.053] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0078.053] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.053] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.053] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.054] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\588bce7c90097ed212\\1030\\", NtPathName=0x2d3fcec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\588bce7c90097ed212\\1030\\", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0078.054] NtCreateFile (in: FileHandle=0x2d3fcf4, DesiredAccess=0x80000000, ObjectAttributes=0x2d3fccc*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\588bce7c90097ed212\\1030\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2d3fce4, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x2d3fcf4*=0x1b0, IoStatusBlock=0x2d3fce4*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0078.055] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x1071818 [0078.055] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0078.065] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0078.065] PathFindFileNameW (pszPath="eula.rtf") returned="eula.rtf" [0078.065] _wcslwr (in: _String=0x2d3f3c4 | out: _String="eula.rtf") returned="eula.rtf" [0078.065] PathFindExtensionW (pszPath="eula.rtf") returned=".rtf" [0078.065] lstrcatW (in: lpString1="", lpString2="rtf" | out: lpString1="rtf") returned="rtf" [0078.066] _wcslwr (in: _String=0x107b450 | out: _String="rtf") returned="rtf" [0078.066] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x1091670 [0078.066] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e4e8 [0078.066] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x106d600 [0078.066] lstrcpyW (in: lpString1=0x106e4e8, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0078.066] lstrcpyW (in: lpString1=0x106d600, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0078.066] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1030\\" [0078.066] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030\\", lpString2="eula.rtf" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" [0078.066] PathFindFileNameW (pszPath="LocalizedData.xml") returned="LocalizedData.xml" [0078.066] _wcslwr (in: _String=0x2d3f3c4 | out: _String="localizeddata.xml") returned="localizeddata.xml" [0078.066] PathFindExtensionW (pszPath="LocalizedData.xml") returned=".xml" [0078.066] lstrcatW (in: lpString1="", lpString2="xml" | out: lpString1="xml") returned="xml" [0078.066] _wcslwr (in: _String=0x107b450 | out: _String="xml") returned="xml" [0078.066] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x10916a8 [0078.066] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x106e178 [0078.066] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x10959c8 [0078.066] lstrcpyW (in: lpString1=0x106e178, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0078.066] lstrcpyW (in: lpString1=0x10959c8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0078.067] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030\\") returned="\\\\?\\C:\\588bce7c90097ed212\\1030\\" [0078.067] lstrcatW (in: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030\\", lpString2="LocalizedData.xml" | out: lpString1="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" [0078.067] PathFindFileNameW (pszPath="SetupResources.dll") returned="SetupResources.dll" [0078.067] _wcslwr (in: _String=0x2d3f3c4 | out: _String="setupresources.dll") returned="setupresources.dll" [0078.067] PathFindExtensionW (pszPath="SetupResources.dll") returned=".dll" [0078.067] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0078.067] _wcslwr (in: _String=0x107b450 | out: _String="dll") returned="dll" [0078.067] NtQueryDirectoryFile (in: FileHandle=0x1b0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x2d3fc80, FileInformation=0x1071818, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x2d3fc80, FileInformation=0x1071818) returned 0x103 [0078.068] NtWaitForSingleObject (Object=0x1b0, Alertable=0, Time=0x0) returned 0x0 [0078.068] LocalFree (hMem=0x1071818) returned 0x0 [0078.068] NtClose (Handle=0x1b0) returned 0x0 [0078.068] GetProcessHeap () returned 0x1050000 [0078.068] HeapFree (in: hHeap=0x1050000, dwFlags=0x0, lpMem=0x108e6d8 | out: hHeap=0x1050000) returned 1 [0078.068] LocalFree (hMem=0x106e7a8) returned 0x0 [0078.068] LocalFree (hMem=0x10717f0) returned 0x0 [0078.068] LocalFree (hMem=0x1071700) returned 0x0 [0078.068] StrCpyNW (in: psz1=0x106f114, psz2="C:\\588bce7c90097ed212\\1031\\", cchMax=252 | out: psz1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0078.069] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.069] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.069] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.069] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.069] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.069] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.069] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.069] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.069] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.070] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.070] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.070] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.070] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.070] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.070] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.071] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.071] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.072] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.072] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.072] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.072] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.072] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.072] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.072] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0078.072] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.072] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.072] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.073] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.073] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.074] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.074] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.074] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.074] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.074] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.074] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.074] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.074] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.075] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.076] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.076] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.076] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.076] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.076] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.076] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.076] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.076] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.077] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.078] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.078] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.078] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.078] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.078] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.078] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.078] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.079] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.079] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.080] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.080] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.080] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.080] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.080] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.081] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.081] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.081] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.081] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.082] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.082] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.082] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.082] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.083] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0078.083] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.083] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.083] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.083] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.083] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.084] RtlUpcaseUnicodeChar (Source=0x32) returned 0x32 [0078.084] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.085] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.085] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x33) returned 0x33 [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x31) returned 0x31 [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0078.085] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0078.085] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.085] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.086] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.086] RtlUpcaseUnicodeChar (Source=0x35) returned 0x35 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x37) returned 0x37 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x39) returned 0x39 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x30) returned 0x30 [0078.086] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0078.086] RtlUpcaseUnicodeChar (Source=0x39) returned