# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 22.04.2020 00:26:44.526 Process: id = "1" image_name = "lzos7pkb4i7msnxm.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lzos7pkb4i7msnxm.exe" page_root = "0x49987000" os_pid = "0x318" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LZOS7pKb4I7msNxm.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x6c0 [0056.799] AllocConsole () returned 1 [0056.920] GetCurrentProcessId () returned 0x318 [0056.920] AttachConsole (dwProcessId=0x318) returned 0 [0056.920] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x7516e8 [0056.921] Wow64DisableWow64FsRedirection (in: OldValue=0x3bfbd8 | out: OldValue=0x3bfbd8*=0x0) returned 1 [0056.921] LocalAlloc (uFlags=0x40, uBytes=0x150) returned 0x751718 [0056.921] CryptAcquireContextW (in: phProv=0x29f748, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x29f748*=0x7519d8) returned 1 [0059.225] GetActiveWindow () returned 0x0 [0059.225] GetCapture () returned 0x0 [0059.225] GetClipboardOwner () returned 0x0 [0059.225] GetClipboardViewer () returned 0x0 [0059.225] GetCurrentProcess () returned 0xffffffff [0059.225] GetCurrentProcessId () returned 0x318 [0059.225] GetCurrentThread () returned 0xfffffffe [0059.225] GetCurrentThreadId () returned 0x6c0 [0059.225] GetTickCount () returned 0x1148d04 [0059.225] GetDesktopWindow () returned 0x10010 [0059.225] GetFocus () returned 0x0 [0059.226] GetInputState () returned 0 [0059.226] GetMessagePos () returned 0x0 [0059.226] GetMessageTime () returned 0 [0059.226] GetOpenClipboardWindow () returned 0x0 [0059.226] GetProcessHeap () returned 0x740000 [0059.226] GetProcessWindowStation () returned 0x48 [0059.226] GetQueueStatus (flags=0x4bf) returned 0x0 [0059.226] GetCaretPos (in: lpPoint=0x3bfb98 | out: lpPoint=0x3bfb98) returned 1 [0059.226] GetCursorPos (in: lpPoint=0x3bfb98 | out: lpPoint=0x3bfb98*(x=805, y=451)) returned 1 [0059.227] GlobalMemoryStatus (in: lpBuffer=0x3bfb50 | out: lpBuffer=0x3bfb50) [0059.227] GetCurrentThread () returned 0xfffffffe [0059.227] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x3bfb90, lpExitTime=0x3bfb88, lpKernelTime=0x3bfb80, lpUserTime=0x3bfb78 | out: lpCreationTime=0x3bfb90, lpExitTime=0x3bfb88, lpKernelTime=0x3bfb80, lpUserTime=0x3bfb78) returned 1 [0059.227] GetCurrentProcess () returned 0xffffffff [0059.227] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x3bfb90, lpExitTime=0x3bfb88, lpKernelTime=0x3bfb80, lpUserTime=0x3bfb78 | out: lpCreationTime=0x3bfb90, lpExitTime=0x3bfb88, lpKernelTime=0x3bfb80, lpUserTime=0x3bfb78) returned 1 [0060.039] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0x3bfbac, lpMaximumWorkingSetSize=0x3bfba8 | out: lpMinimumWorkingSetSize=0x3bfbac, lpMaximumWorkingSetSize=0x3bfba8) returned 1 [0060.039] GetStartupInfoW (in: lpStartupInfo=0x3bfb0c | out: lpStartupInfo=0x3bfb0c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LZOS7pKb4I7msNxm.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x75666493, hStdOutput=0x756664cb, hStdError=0xc9856fef)) [0060.039] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfb70 | out: lpPerformanceCount=0x3bfb70*=17880785084) returned 1 [0060.039] CryptGenRandom (in: hProv=0x7519d8, dwLen=0x140, pbBuffer=0x29f768 | out: pbBuffer=0x29f768) returned 1 [0060.039] GetActiveWindow () returned 0x0 [0060.040] GetCapture () returned 0x0 [0060.040] GetClipboardOwner () returned 0x0 [0060.040] GetClipboardViewer () returned 0x0 [0060.040] GetCurrentProcess () returned 0xffffffff [0060.040] GetCurrentProcessId () returned 0x318 [0060.040] GetCurrentThread () returned 0xfffffffe [0060.040] GetCurrentThreadId () returned 0x6c0 [0060.040] GetTickCount () returned 0x114903f [0060.040] GetDesktopWindow () returned 0x10010 [0060.040] GetFocus () returned 0x0 [0060.040] GetInputState () returned 0 [0060.040] GetMessagePos () returned 0x0 [0060.040] GetMessageTime () returned 0 [0060.040] GetOpenClipboardWindow () returned 0x0 [0060.040] GetProcessHeap () returned 0x740000 [0060.040] GetProcessWindowStation () returned 0x48 [0060.040] GetQueueStatus (flags=0x4bf) returned 0x0 [0060.040] GetCaretPos (in: lpPoint=0x3bfb90 | out: lpPoint=0x3bfb90) returned 1 [0060.040] GetCursorPos (in: lpPoint=0x3bfb90 | out: lpPoint=0x3bfb90*(x=805, y=451)) returned 1 [0060.040] GlobalMemoryStatus (in: lpBuffer=0x3bfb48 | out: lpBuffer=0x3bfb48) [0060.040] GetCurrentThread () returned 0xfffffffe [0060.040] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x3bfb88, lpExitTime=0x3bfb80, lpKernelTime=0x3bfb78, lpUserTime=0x3bfb70 | out: lpCreationTime=0x3bfb88, lpExitTime=0x3bfb80, lpKernelTime=0x3bfb78, lpUserTime=0x3bfb70) returned 1 [0060.040] GetCurrentProcess () returned 0xffffffff [0060.041] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x3bfb88, lpExitTime=0x3bfb80, lpKernelTime=0x3bfb78, lpUserTime=0x3bfb70 | out: lpCreationTime=0x3bfb88, lpExitTime=0x3bfb80, lpKernelTime=0x3bfb78, lpUserTime=0x3bfb70) returned 1 [0060.041] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0x3bfba4, lpMaximumWorkingSetSize=0x3bfba0 | out: lpMinimumWorkingSetSize=0x3bfba4, lpMaximumWorkingSetSize=0x3bfba0) returned 1 [0060.041] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfb68 | out: lpPerformanceCount=0x3bfb68*=17880924132) returned 1 [0060.041] CryptGenRandom (in: hProv=0x7519d8, dwLen=0x140, pbBuffer=0x29f768 | out: pbBuffer=0x29f768) returned 1 [0060.041] LocalAlloc (uFlags=0x40, uBytes=0x150) returned 0x754b68 [0060.041] GetActiveWindow () returned 0x0 [0060.041] GetCapture () returned 0x0 [0060.041] GetClipboardOwner () returned 0x0 [0060.041] GetClipboardViewer () returned 0x0 [0060.041] GetCurrentProcess () returned 0xffffffff [0060.041] GetCurrentProcessId () returned 0x318 [0060.041] GetCurrentThread () returned 0xfffffffe [0060.041] GetCurrentThreadId () returned 0x6c0 [0060.041] GetTickCount () returned 0x114903f [0060.041] GetDesktopWindow () returned 0x10010 [0060.041] GetFocus () returned 0x0 [0060.041] GetInputState () returned 0 [0060.041] GetMessagePos () returned 0x0 [0060.041] GetMessageTime () returned 0 [0060.041] GetOpenClipboardWindow () returned 0x0 [0060.041] GetProcessHeap () returned 0x740000 [0060.041] GetProcessWindowStation () returned 0x48 [0060.041] GetQueueStatus (flags=0x4bf) returned 0x0 [0060.041] GetCaretPos (in: lpPoint=0x3bfb74 | out: lpPoint=0x3bfb74) returned 1 [0060.042] GetCursorPos (in: lpPoint=0x3bfb74 | out: lpPoint=0x3bfb74*(x=805, y=451)) returned 1 [0060.042] GlobalMemoryStatus (in: lpBuffer=0x3bfb2c | out: lpBuffer=0x3bfb2c) [0060.042] GetCurrentThread () returned 0xfffffffe [0060.042] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54 | out: lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54) returned 1 [0060.042] GetCurrentProcess () returned 0xffffffff [0060.042] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54 | out: lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54) returned 1 [0060.042] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0x3bfb88, lpMaximumWorkingSetSize=0x3bfb84 | out: lpMinimumWorkingSetSize=0x3bfb88, lpMaximumWorkingSetSize=0x3bfb84) returned 1 [0060.042] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfb4c | out: lpPerformanceCount=0x3bfb4c*=17881055599) returned 1 [0060.042] CryptGenRandom (in: hProv=0x7519d8, dwLen=0x140, pbBuffer=0x29f768 | out: pbBuffer=0x29f768) returned 1 [0060.042] GetActiveWindow () returned 0x0 [0060.042] GetCapture () returned 0x0 [0060.042] GetClipboardOwner () returned 0x0 [0060.042] GetClipboardViewer () returned 0x0 [0060.042] GetCurrentProcess () returned 0xffffffff [0060.042] GetCurrentProcessId () returned 0x318 [0060.042] GetCurrentThread () returned 0xfffffffe [0060.042] GetCurrentThreadId () returned 0x6c0 [0060.042] GetTickCount () returned 0x114903f [0060.042] GetDesktopWindow () returned 0x10010 [0060.042] GetFocus () returned 0x0 [0060.042] GetInputState () returned 0 [0060.043] GetMessagePos () returned 0x0 [0060.043] GetMessageTime () returned 0 [0060.043] GetOpenClipboardWindow () returned 0x0 [0060.043] GetProcessHeap () returned 0x740000 [0060.043] GetProcessWindowStation () returned 0x48 [0060.043] GetQueueStatus (flags=0x4bf) returned 0x0 [0060.043] GetCaretPos (in: lpPoint=0x3bfb74 | out: lpPoint=0x3bfb74) returned 1 [0060.043] GetCursorPos (in: lpPoint=0x3bfb74 | out: lpPoint=0x3bfb74*(x=805, y=451)) returned 1 [0060.043] GlobalMemoryStatus (in: lpBuffer=0x3bfb2c | out: lpBuffer=0x3bfb2c) [0060.043] GetCurrentThread () returned 0xfffffffe [0060.043] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54 | out: lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54) returned 1 [0060.043] GetCurrentProcess () returned 0xffffffff [0060.043] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54 | out: lpCreationTime=0x3bfb6c, lpExitTime=0x3bfb64, lpKernelTime=0x3bfb5c, lpUserTime=0x3bfb54) returned 1 [0060.043] GetProcessWorkingSetSize (in: hProcess=0xffffffff, lpMinimumWorkingSetSize=0x3bfb88, lpMaximumWorkingSetSize=0x3bfb84 | out: lpMinimumWorkingSetSize=0x3bfb88, lpMaximumWorkingSetSize=0x3bfb84) returned 1 [0060.043] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfb4c | out: lpPerformanceCount=0x3bfb4c*=17881182143) returned 1 [0060.043] CryptGenRandom (in: hProv=0x7519d8, dwLen=0x140, pbBuffer=0x29f768 | out: pbBuffer=0x29f768) returned 1 [0060.044] CryptAcquireContextW (in: phProv=0x3bf7e4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3bf7e4*=0x754cc0) returned 1 [0060.045] CryptGenRandom (in: hProv=0x754cc0, dwLen=0x80, pbBuffer=0x3bf7f8 | out: pbBuffer=0x3bf7f8) returned 1 [0060.045] CryptReleaseContext (hProv=0x754cc0, dwFlags=0x0) returned 1 [0060.048] CryptAcquireContextW (in: phProv=0x3bf7e4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3bf7e4*=0x754cc0) returned 1 [0060.049] CryptGenRandom (in: hProv=0x754cc0, dwLen=0x80, pbBuffer=0x3bf7f8 | out: pbBuffer=0x3bf7f8) returned 1 [0060.049] CryptReleaseContext (hProv=0x754cc0, dwFlags=0x0) returned 1 [0060.052] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x751870 [0060.052] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ee08 [0060.052] LocalAlloc (uFlags=0x40, uBytes=0x210) returned 0x754cc0 [0060.052] ExpandEnvironmentStringsW (in: lpSrc="%windir%", lpDst=0x754cc0, nSize=0x104 | out: lpDst="C:\\Windows") returned 0xb [0060.061] _wcslwr (in: _String=0x754cc0 | out: _String="c:\\windows") returned="c:\\windows" [0060.061] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74ee20 [0060.061] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ee38 [0060.061] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x751918 [0060.062] lstrcpyW (in: lpString1=0x751918, lpString2=":\\$RECYCLE.BIN\\" | out: lpString1=":\\$RECYCLE.BIN\\") returned=":\\$RECYCLE.BIN\\" [0060.062] _wcslwr (in: _String=0x751918 | out: _String=":\\$recycle.bin\\") returned=":\\$recycle.bin\\" [0060.062] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74ee50 [0060.062] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ee68 [0060.062] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x754ed8 [0060.062] lstrcpyW (in: lpString1=0x754ed8, lpString2="\\windows\\system32\\" | out: lpString1="\\windows\\system32\\") returned="\\windows\\system32\\" [0060.062] _wcslwr (in: _String=0x754ed8 | out: _String="\\windows\\system32\\") returned="\\windows\\system32\\" [0060.062] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74ee80 [0060.062] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ee98 [0060.062] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x754f20 [0060.062] lstrcpyW (in: lpString1=0x754f20, lpString2="\\windows\\syswow64\\" | out: lpString1="\\windows\\syswow64\\") returned="\\windows\\syswow64\\" [0060.062] _wcslwr (in: _String=0x754f20 | out: _String="\\windows\\syswow64\\") returned="\\windows\\syswow64\\" [0060.062] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74eeb0 [0060.062] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74eec8 [0060.062] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x754f80 [0060.062] lstrcpyW (in: lpString1=0x754f80, lpString2="\\windows\\system\\" | out: lpString1="\\windows\\system\\") returned="\\windows\\system\\" [0060.062] _wcslwr (in: _String=0x754f80 | out: _String="\\windows\\system\\") returned="\\windows\\system\\" [0060.063] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74eee0 [0060.063] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74eef8 [0060.063] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x754fc8 [0060.063] lstrcpyW (in: lpString1=0x754fc8, lpString2="\\windows\\winsxs\\" | out: lpString1="\\windows\\winsxs\\") returned="\\windows\\winsxs\\" [0060.063] _wcslwr (in: _String=0x754fc8 | out: _String="\\windows\\winsxs\\") returned="\\windows\\winsxs\\" [0060.063] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74ef10 [0060.063] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ef28 [0060.063] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x755f80 [0060.066] lstrcpyW (in: lpString1=0x755f80, lpString2="\\System\\msadc\\" | out: lpString1="\\System\\msadc\\") returned="\\System\\msadc\\" [0060.066] _wcslwr (in: _String=0x755f80 | out: _String="\\system\\msadc\\") returned="\\system\\msadc\\" [0060.066] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74ef40 [0060.066] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ef58 [0060.066] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x755fb8 [0060.066] lstrcpyW (in: lpString1=0x755fb8, lpString2="\\Common Files\\" | out: lpString1="\\Common Files\\") returned="\\Common Files\\" [0060.066] _wcslwr (in: _String=0x755fb8 | out: _String="\\common files\\") returned="\\common files\\" [0060.066] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x74ef70 [0060.066] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x74ef88 [0060.066] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755010 [0060.066] lstrcpyW (in: lpString1=0x755010, lpString2="\\WindowsPowerShell\\" | out: lpString1="\\WindowsPowerShell\\") returned="\\WindowsPowerShell\\" [0060.066] _wcslwr (in: _String=0x755010 | out: _String="\\windowspowershell\\") returned="\\windowspowershell\\" [0060.066] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756780 [0060.066] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756798 [0060.066] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x756b68 [0060.066] lstrcpyW (in: lpString1=0x756b68, lpString2="\\Program Files\\Internet Explorer\\" | out: lpString1="\\Program Files\\Internet Explorer\\") returned="\\Program Files\\Internet Explorer\\" [0060.066] _wcslwr (in: _String=0x756b68 | out: _String="\\program files\\internet explorer\\") returned="\\program files\\internet explorer\\" [0060.067] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7567b0 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7567c8 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x756bd0 [0060.067] lstrcpyW (in: lpString1=0x756bd0, lpString2="\\Program Files\\Microsoft Games\\" | out: lpString1="\\Program Files\\Microsoft Games\\") returned="\\Program Files\\Microsoft Games\\" [0060.067] _wcslwr (in: _String=0x756bd0 | out: _String="\\program files\\microsoft games\\") returned="\\program files\\microsoft games\\" [0060.067] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7567e0 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7567f8 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755058 [0060.067] lstrcpyW (in: lpString1=0x755058, lpString2="\\all users\\microsoft\\" | out: lpString1="\\all users\\microsoft\\") returned="\\all users\\microsoft\\" [0060.067] _wcslwr (in: _String=0x755058 | out: _String="\\all users\\microsoft\\") returned="\\all users\\microsoft\\" [0060.067] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756810 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756828 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x755ff0 [0060.067] lstrcpyW (in: lpString1=0x755ff0, lpString2="\\inetpub\\logs\\" | out: lpString1="\\inetpub\\logs\\") returned="\\inetpub\\logs\\" [0060.067] _wcslwr (in: _String=0x755ff0 | out: _String="\\inetpub\\logs\\") returned="\\inetpub\\logs\\" [0060.067] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756840 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756858 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x7508a8 [0060.067] lstrcpyW (in: lpString1=0x7508a8, lpString2=":\\boot\\" | out: lpString1=":\\boot\\") returned=":\\boot\\" [0060.067] _wcslwr (in: _String=0x7508a8 | out: _String=":\\boot\\") returned=":\\boot\\" [0060.067] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756870 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756888 [0060.067] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x756c28 [0060.068] lstrcpyW (in: lpString1=0x756c28, lpString2=":\\system volume information\\" | out: lpString1=":\\system volume information\\") returned=":\\system volume information\\" [0060.068] _wcslwr (in: _String=0x756c28 | out: _String=":\\system volume information\\") returned=":\\system volume information\\" [0060.068] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7568a0 [0060.068] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7568b8 [0060.068] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756028 [0060.068] lstrcpyW (in: lpString1=0x756028, lpString2=":\\drivers\\" | out: lpString1=":\\drivers\\") returned=":\\drivers\\" [0060.068] _wcslwr (in: _String=0x756028 | out: _String=":\\drivers\\") returned=":\\drivers\\" [0060.068] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7568d0 [0060.068] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7568e8 [0060.068] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x753ed8 [0060.068] lstrcpyW (in: lpString1=0x753ed8, lpString2=":\\wsus\\" | out: lpString1=":\\wsus\\") returned=":\\wsus\\" [0060.069] _wcslwr (in: _String=0x753ed8 | out: _String=":\\wsus\\") returned=":\\wsus\\" [0060.069] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756900 [0060.069] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756918 [0060.069] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x753f00 [0060.069] lstrcpyW (in: lpString1=0x753f00, lpString2="\\cache\\" | out: lpString1="\\cache\\") returned="\\cache\\" [0060.069] _wcslwr (in: _String=0x753f00 | out: _String="\\cache\\") returned="\\cache\\" [0060.069] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756930 [0060.069] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756948 [0060.069] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756060 [0060.069] lstrcpyW (in: lpString1=0x756060, lpString2="\\cache2\\" | out: lpString1="\\cache2\\") returned="\\cache2\\" [0060.069] _wcslwr (in: _String=0x756060 | out: _String="\\cache2\\") returned="\\cache2\\" [0060.069] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756960 [0060.069] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756978 [0060.069] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756098 [0060.069] lstrcpyW (in: lpString1=0x756098, lpString2="\\far manager\\" | out: lpString1="\\far manager\\") returned="\\far manager\\" [0060.069] _wcslwr (in: _String=0x756098 | out: _String="\\far manager\\") returned="\\far manager\\" [0060.070] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756990 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7569a8 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7560d0 [0060.070] lstrcpyW (in: lpString1=0x7560d0, lpString2="\\ida 7.0\\" | out: lpString1="\\ida 7.0\\") returned="\\ida 7.0\\" [0060.070] _wcslwr (in: _String=0x7560d0 | out: _String="\\ida 7.0\\") returned="\\ida 7.0\\" [0060.070] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7569c0 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7569d8 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756108 [0060.070] lstrcpyW (in: lpString1=0x756108, lpString2="\\ida 6.8\\" | out: lpString1="\\ida 6.8\\") returned="\\ida 6.8\\" [0060.070] _wcslwr (in: _String=0x756108 | out: _String="\\ida 6.8\\") returned="\\ida 6.8\\" [0060.070] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7569f0 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756a08 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7550a0 [0060.070] lstrcpyW (in: lpString1=0x7550a0, lpString2="\\Default\\Extensions\\" | out: lpString1="\\Default\\Extensions\\") returned="\\Default\\Extensions\\" [0060.070] _wcslwr (in: _String=0x7550a0 | out: _String="\\default\\extensions\\") returned="\\default\\extensions\\" [0060.070] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756a20 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756a38 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x756c80 [0060.070] lstrcpyW (in: lpString1=0x756c80, lpString2="\\Temporary Internet Files\\" | out: lpString1="\\Temporary Internet Files\\") returned="\\Temporary Internet Files\\" [0060.070] _wcslwr (in: _String=0x756c80 | out: _String="\\temporary internet files\\") returned="\\temporary internet files\\" [0060.070] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756a50 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756a68 [0060.070] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756140 [0060.070] lstrcpyW (in: lpString1=0x756140, lpString2="\\Microsoft\\" | out: lpString1="\\Microsoft\\") returned="\\Microsoft\\" [0060.070] _wcslwr (in: _String=0x756140 | out: _String="\\microsoft\\") returned="\\microsoft\\" [0060.070] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756a80 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756a98 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x753f28 [0060.071] lstrcpyW (in: lpString1=0x753f28, lpString2="\\Temp\\" | out: lpString1="\\Temp\\") returned="\\Temp\\" [0060.071] _wcslwr (in: _String=0x753f28 | out: _String="\\temp\\") returned="\\temp\\" [0060.071] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ab0 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ac8 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756178 [0060.071] lstrcpyW (in: lpString1=0x756178, lpString2="$windows.~bt" | out: lpString1="$windows.~bt") returned="$windows.~bt" [0060.071] _wcslwr (in: _String=0x756178 | out: _String="$windows.~bt") returned="$windows.~bt" [0060.071] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ae0 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756af8 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7561b0 [0060.071] lstrcpyW (in: lpString1=0x7561b0, lpString2="$windows.~ws" | out: lpString1="$windows.~ws") returned="$windows.~ws" [0060.071] _wcslwr (in: _String=0x7561b0 | out: _String="$windows.~ws") returned="$windows.~ws" [0060.071] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756b10 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756b28 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7561e8 [0060.071] lstrcpyW (in: lpString1=0x7561e8, lpString2="\\google\\" | out: lpString1="\\google\\") returned="\\google\\" [0060.071] _wcslwr (in: _String=0x7561e8 | out: _String="\\google\\") returned="\\google\\" [0060.071] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756b40 [0060.071] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756cf0 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756220 [0060.072] lstrcpyW (in: lpString1=0x756220, lpString2="\\mozilla\\" | out: lpString1="\\mozilla\\") returned="\\mozilla\\" [0060.072] _wcslwr (in: _String=0x756220 | out: _String="\\mozilla\\") returned="\\mozilla\\" [0060.072] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756d08 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756d20 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756258 [0060.072] lstrcpyW (in: lpString1=0x756258, lpString2="\\tor browser\\" | out: lpString1="\\tor browser\\") returned="\\tor browser\\" [0060.072] _wcslwr (in: _String=0x756258 | out: _String="\\tor browser\\") returned="\\tor browser\\" [0060.072] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756d38 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756d50 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756290 [0060.072] lstrcpyW (in: lpString1=0x756290, lpString2="\\windows.old\\" | out: lpString1="\\windows.old\\") returned="\\windows.old\\" [0060.072] _wcslwr (in: _String=0x756290 | out: _String="\\windows.old\\") returned="\\windows.old\\" [0060.072] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756d68 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756d80 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x753f50 [0060.072] lstrcpyW (in: lpString1=0x753f50, lpString2="\\intel\\" | out: lpString1="\\intel\\") returned="\\intel\\" [0060.072] _wcslwr (in: _String=0x753f50 | out: _String="\\intel\\") returned="\\intel\\" [0060.072] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756d98 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756db0 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7562c8 [0060.072] lstrcpyW (in: lpString1=0x7562c8, lpString2="\\msocache\\" | out: lpString1="\\msocache\\") returned="\\msocache\\" [0060.072] _wcslwr (in: _String=0x7562c8 | out: _String="\\msocache\\") returned="\\msocache\\" [0060.072] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756dc8 [0060.072] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756de0 [0060.073] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756300 [0060.073] lstrcpyW (in: lpString1=0x756300, lpString2="\\perflogs\\" | out: lpString1="\\perflogs\\") returned="\\perflogs\\" [0060.073] _wcslwr (in: _String=0x756300 | out: _String="\\perflogs\\") returned="\\perflogs\\" [0060.073] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756df8 [0060.073] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7550e8 [0060.073] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x7570d8 [0060.073] CryptAcquireContextW (in: phProv=0x29f748, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x29f748*=0x7571b0) returned 1 [0060.074] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0060.074] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e10 [0060.074] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x756e10 | out: lpBuffer="C:\\") returned 0x4 [0060.074] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.074] LocalAlloc (uFlags=0x40, uBytes=0x5a0) returned 0x7573e0 [0060.074] StrDupW (lpSrch="C:\\") returned="C:\\" [0060.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x28f8f0, lpParameter=0x7573e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60 [0060.076] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e28 [0060.076] GetLastError () returned 0x0 [0060.077] lstrlenA (lpString="DRIVE_FIXED : %ws\n") returned 18 [0060.077] LocalAlloc (uFlags=0x40, uBytes=0x213) returned 0x7579a8 [0060.078] wvnsprintfA (in: pszDest=0x7579a8, cchDest=530, pszFmt="DRIVE_FIXED : %ws\n", arglist=0x3bfbc4 | out: pszDest="DRIVE_FIXED : C:\\\n") returned 18 [0060.079] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0060.079] WriteFile (in: hFile=0x7, lpBuffer=0x7579a8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x7579a8*, lpNumberOfBytesWritten=0x3bfb98*=0x12, lpOverlapped=0x0) returned 1 [0060.080] OutputDebugStringA (lpOutputString="DRIVE_FIXED : C:\\\n") [0060.086] FlushFileBuffers (hFile=0x7) returned 0 [0060.297] LocalFree (hMem=0x7579a8) returned 0x0 [0060.297] SetLastError (dwErrCode=0x0) [0060.297] WaitForSingleObject (hHandle=0x60, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x644 [0060.087] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x757dd8 [0060.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x293540, lpParameter=0x757dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74 [0060.088] GetTickCount () returned 0x114906e [0060.088] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e88 [0060.088] LocalAlloc (uFlags=0x40, uBytes=0xfb0) returned 0x757e48 [0060.089] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x758e00 [0060.089] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e70 [0060.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x28f700, lpParameter=0x7573e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78 [0060.092] CloseHandle (hObject=0x78) returned 1 [0060.093] StrCpyNW (in: psz1=0x757544, psz2="C:\\", cchMax=252 | out: psz1="C:\\") returned="C:\\" [0060.093] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.093] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.093] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.093] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.093] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.093] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.093] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.093] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.093] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.093] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.093] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.094] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.094] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.094] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.094] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.094] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.095] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.095] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.095] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.095] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.095] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.095] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.095] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.096] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.096] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.096] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.096] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.096] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.096] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.096] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.096] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.097] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.097] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.097] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.097] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.097] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.097] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.098] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.098] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.098] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.098] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.099] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.099] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.099] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.099] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.099] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.099] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.099] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.099] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.099] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.099] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.100] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.100] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.101] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.101] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.101] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.101] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.101] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.101] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.101] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.102] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.102] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.102] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.102] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.102] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.102] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.102] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.102] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.103] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.103] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.103] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.103] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.103] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.103] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.103] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.103] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.103] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.104] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.104] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.104] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.104] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.104] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.104] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.104] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.104] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.104] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.104] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.104] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.105] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.105] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.105] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.105] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.105] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.105] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.106] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.106] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.106] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.106] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.106] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.106] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756338 [0060.106] wsprintfW (in: param_1=0x756338, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\") returned 7 [0060.106] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\" | out: DestinationString="\\??\\C:\\") [0060.106] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x78, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.107] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.107] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.108] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.108] LocalAlloc (uFlags=0x40, uBytes=0x8010) returned 0x759e68 [0060.108] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756370 [0060.108] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754018 [0060.108] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x761e80 [0060.109] lstrcpyW (in: lpString1=0x754018, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.109] lstrcpyW (in: lpString1=0x761e80, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.109] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.109] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e58 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755130 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e40 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7563e0 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754040 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x761ee8 [0060.109] lstrcpyW (in: lpString1=0x754040, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.109] lstrcpyW (in: lpString1=0x761ee8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.109] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.109] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ea0 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756418 [0060.109] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756eb8 [0060.109] PathFindFileNameW (pszPath="bootmgr") returned="bootmgr" [0060.110] _wcslwr (in: _String=0x246f54c | out: _String="bootmgr") returned="bootmgr" [0060.110] PathFindFileNameW (pszPath="BOOTSECT.BAK") returned="BOOTSECT.BAK" [0060.110] _wcslwr (in: _String=0x246f54c | out: _String="bootsect.bak") returned="bootsect.bak" [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756450 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754068 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x761f50 [0060.110] lstrcpyW (in: lpString1=0x754068, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.110] lstrcpyW (in: lpString1=0x761f50, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.110] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.110] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ed0 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755178 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ee8 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756488 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754090 [0060.110] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x761fb8 [0060.110] lstrcpyW (in: lpString1=0x754090, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.110] lstrcpyW (in: lpString1=0x761fb8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.110] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.111] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f00 [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x762020 [0060.111] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f18 [0060.111] PathFindFileNameW (pszPath="hiberfil.sys") returned="hiberfil.sys" [0060.111] _wcslwr (in: _String=0x246f54c | out: _String="hiberfil.sys") returned="hiberfil.sys" [0060.111] PathFindExtensionW (pszPath="hiberfil.sys") returned=".sys" [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x410) returned 0x762078 [0060.111] lstrcatW (in: lpString1="", lpString2="sys" | out: lpString1="sys") returned="sys" [0060.111] _wcslwr (in: _String=0x762078 | out: _String="sys") returned="sys" [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7564c0 [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x7540b8 [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x762490 [0060.111] lstrcpyW (in: lpString1=0x7540b8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.111] lstrcpyW (in: lpString1=0x762490, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.111] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.111] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f30 [0060.111] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7564f8 [0060.111] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f48 [0060.112] PathFindFileNameW (pszPath="pagefile.sys") returned="pagefile.sys" [0060.112] _wcslwr (in: _String=0x246f54c | out: _String="pagefile.sys") returned="pagefile.sys" [0060.112] PathFindExtensionW (pszPath="pagefile.sys") returned=".sys" [0060.112] lstrcatW (in: lpString1="", lpString2="sys" | out: lpString1="sys") returned="sys" [0060.112] _wcslwr (in: _String=0x762078 | out: _String="sys") returned="sys" [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756530 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x7540e0 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7624f8 [0060.112] lstrcpyW (in: lpString1=0x7540e0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.112] lstrcpyW (in: lpString1=0x7624f8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.112] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.112] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f60 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756568 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f78 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7565a0 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754108 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x762560 [0060.112] lstrcpyW (in: lpString1=0x754108, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.112] lstrcpyW (in: lpString1=0x762560, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.112] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.112] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f90 [0060.112] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7551c0 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756fa8 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7565d8 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754130 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7625c8 [0060.113] lstrcpyW (in: lpString1=0x754130, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.113] lstrcpyW (in: lpString1=0x7625c8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.113] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.113] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756fc0 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x762630 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756fd8 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756610 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754158 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x762688 [0060.113] lstrcpyW (in: lpString1=0x754158, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.113] lstrcpyW (in: lpString1=0x762688, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.113] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.113] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ff0 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755208 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757008 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756648 [0060.113] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754180 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7626f0 [0060.114] lstrcpyW (in: lpString1=0x754180, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.114] lstrcpyW (in: lpString1=0x7626f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.114] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.114] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757020 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756680 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757038 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7566b8 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x7541a8 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x762758 [0060.114] lstrcpyW (in: lpString1=0x7541a8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.114] lstrcpyW (in: lpString1=0x762758, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.114] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.114] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757050 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7627c0 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757068 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7566f0 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x7541d0 [0060.114] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x762818 [0060.114] lstrcpyW (in: lpString1=0x7541d0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.115] lstrcpyW (in: lpString1=0x762818, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.115] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.115] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757080 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756728 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757098 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762898 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x7541f8 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x763080 [0060.115] lstrcpyW (in: lpString1=0x7541f8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0060.115] lstrcpyW (in: lpString1=0x763080, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.115] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0060.115] lstrcatW (in: lpString1="\\\\?\\C:\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\!!_FILES_ENCRYPTED_.txt" [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7570b0 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7628d0 [0060.115] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763100 [0060.115] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.116] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.116] LocalFree (hMem=0x758e50) returned 0x0 [0060.116] NtClose (Handle=0x78) returned 0x0 [0060.116] LocalFree (hMem=0x756338) returned 0x0 [0060.116] LocalFree (hMem=0x756e88) returned 0x0 [0060.116] LocalFree (hMem=0x756e70) returned 0x0 [0060.116] StrCpyNW (in: psz1=0x757544, psz2="C:\\$Recycle.Bin\\", cchMax=252 | out: psz1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0060.116] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.116] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.116] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.116] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.116] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.116] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.116] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.116] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.116] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.116] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.117] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.117] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.117] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.117] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.117] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.117] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.117] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.118] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.118] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.118] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.118] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.118] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.118] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.118] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.118] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.118] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.118] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.118] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.118] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.118] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.118] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.118] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.118] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.118] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.118] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.119] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.119] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.119] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.119] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.119] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.119] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.119] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.119] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.119] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.119] LocalFree (hMem=0x755130) returned 0x0 [0060.119] LocalFree (hMem=0x756e58) returned 0x0 [0060.119] LocalFree (hMem=0x756e40) returned 0x0 [0060.119] StrCpyNW (in: psz1=0x757544, psz2="C:\\Boot\\", cchMax=252 | out: psz1="C:\\Boot\\") returned="C:\\Boot\\" [0060.119] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.119] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.119] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.119] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.119] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.119] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.119] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.119] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.119] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.119] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.119] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.120] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.120] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.120] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.120] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.120] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.120] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.120] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.120] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.120] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.120] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.120] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.120] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.120] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.120] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.120] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.121] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.121] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.121] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.121] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.121] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.121] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.121] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.122] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.122] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.122] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.122] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.122] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.123] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.123] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.123] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.123] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.123] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.123] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.123] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.123] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.124] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.124] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.124] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.124] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.124] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.125] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.125] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.125] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.125] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.125] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.125] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.125] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.125] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.126] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.126] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.126] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.126] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.126] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.126] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.126] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.127] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.127] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.127] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.127] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.127] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.128] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.128] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.128] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.128] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.128] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.128] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.128] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.128] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.129] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.129] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.129] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.129] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.129] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.129] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.129] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.129] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.129] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.129] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.129] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.129] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.129] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.129] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.129] LocalFree (hMem=0x756418) returned 0x0 [0060.129] LocalFree (hMem=0x756ea0) returned 0x0 [0060.129] LocalFree (hMem=0x756eb8) returned 0x0 [0060.130] StrCpyNW (in: psz1=0x757544, psz2="C:\\Config.Msi\\", cchMax=252 | out: psz1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0060.130] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.130] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.130] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.130] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.130] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.130] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.130] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.130] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.130] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.130] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.131] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.131] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.131] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.131] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.131] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.131] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.131] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.131] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.131] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.132] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.132] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.132] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.132] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.133] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.133] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.133] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.133] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.133] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.133] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.134] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.134] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.134] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.134] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.134] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.134] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.135] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.135] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.135] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.135] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.135] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.135] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.136] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.136] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.136] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.137] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.137] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.137] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.137] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.137] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.137] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.138] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.138] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.138] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.138] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.139] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.139] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.139] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.139] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.139] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.139] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.139] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.139] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.139] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.140] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.140] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.140] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.140] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.140] RtlUpcaseUnicodeChar (Source=0x2e) returned 0x2e [0060.140] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.141] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.141] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.141] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.141] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.141] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.141] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.141] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755130 [0060.141] wsprintfW (in: param_1=0x755130, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Config.Msi\\") returned 18 [0060.141] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Config.Msi\\" | out: DestinationString="\\??\\C:\\Config.Msi\\") [0060.141] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Config.Msi\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x78, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.143] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.143] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.143] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.143] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.143] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.143] LocalFree (hMem=0x758e50) returned 0x0 [0060.143] NtClose (Handle=0x78) returned 0x0 [0060.144] LocalFree (hMem=0x755130) returned 0x0 [0060.144] LocalFree (hMem=0x755178) returned 0x0 [0060.144] LocalFree (hMem=0x756ed0) returned 0x0 [0060.144] LocalFree (hMem=0x756ee8) returned 0x0 [0060.144] StrCpyNW (in: psz1=0x757544, psz2="C:\\Documents and Settings\\", cchMax=252 | out: psz1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0060.144] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.144] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.144] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.144] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.144] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.144] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.144] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.144] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.144] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.144] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.145] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.145] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.146] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.146] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.146] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.146] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.146] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.146] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.146] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.146] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.146] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.146] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.146] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.146] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.146] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.146] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.146] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.146] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.146] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.146] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.146] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.146] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.147] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.147] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.148] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.148] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.148] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.148] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.149] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.149] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.150] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.150] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.150] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.150] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.150] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.150] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.151] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.151] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.152] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.152] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.152] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.152] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.152] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.152] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.153] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.154] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.154] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.154] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.154] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.154] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.154] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.155] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.155] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.155] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.155] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.156] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.156] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.156] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.156] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.157] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.157] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.157] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.158] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.158] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.158] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.158] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.159] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.159] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.159] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.159] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.160] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.160] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.160] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.161] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.161] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.161] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.162] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.162] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.162] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.162] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.163] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.163] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.163] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.163] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.163] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.163] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.163] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.163] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7634e8 [0060.163] wsprintfW (in: param_1=0x7634e8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Documents and Settings\\") returned 30 [0060.163] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Documents and Settings\\" | out: DestinationString="\\??\\C:\\Documents and Settings\\") [0060.163] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Documents and Settings\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x0, IoStatusBlock=0x246f76c*(Status=0x246f750, Pointer=0x246f750, Information=0x0)) returned 0xc0000022 [0060.164] LocalFree (hMem=0x7634e8) returned 0x0 [0060.164] LocalFree (hMem=0x762020) returned 0x0 [0060.164] LocalFree (hMem=0x756f00) returned 0x0 [0060.164] LocalFree (hMem=0x756f18) returned 0x0 [0060.164] StrCpyNW (in: psz1=0x757544, psz2="C:\\MSOCache\\", cchMax=252 | out: psz1="C:\\MSOCache\\") returned="C:\\MSOCache\\" [0060.164] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.164] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.164] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.164] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.164] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.165] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.165] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.165] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.165] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.165] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.165] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.165] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.165] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.165] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.165] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.165] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.165] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.166] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.166] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.166] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.166] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.166] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.166] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.166] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.166] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.166] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.166] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.166] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.167] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.167] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.167] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.167] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.167] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.167] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.167] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.168] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.168] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.168] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.168] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.168] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.168] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.169] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.169] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.169] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.169] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.169] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.169] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.170] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.170] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.170] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.170] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.170] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.170] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.171] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.171] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.171] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.171] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.171] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.171] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.172] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.172] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.172] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.173] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.173] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.173] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.173] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.173] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.174] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.174] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.174] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.174] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.174] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.175] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.175] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.175] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.175] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.175] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.176] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.176] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.176] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.176] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.176] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.177] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.177] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.177] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.178] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.178] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.178] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.179] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.179] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.179] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.179] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.179] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.179] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.179] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.179] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.179] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.179] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.179] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.180] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.180] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.180] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.180] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.180] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.180] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.181] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.181] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.181] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.181] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.181] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.181] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.182] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.182] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.182] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.182] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.182] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.182] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.183] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.183] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.183] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.183] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.184] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.184] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.184] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.184] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.184] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.184] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.185] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.185] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.185] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.186] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.186] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.186] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.186] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.186] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.187] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.187] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.187] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.187] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.187] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.187] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.187] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.187] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.187] LocalFree (hMem=0x7564f8) returned 0x0 [0060.187] LocalFree (hMem=0x756f30) returned 0x0 [0060.187] LocalFree (hMem=0x756f48) returned 0x0 [0060.187] StrCpyNW (in: psz1=0x757544, psz2="C:\\PerfLogs\\", cchMax=252 | out: psz1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0060.187] LocalFree (hMem=0x756568) returned 0x0 [0060.187] LocalFree (hMem=0x756f60) returned 0x0 [0060.187] LocalFree (hMem=0x756f78) returned 0x0 [0060.187] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\", cchMax=252 | out: psz1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.187] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x762020 [0060.187] wsprintfW (in: param_1=0x762020, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\") returned 21 [0060.188] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\" | out: DestinationString="\\??\\C:\\Program Files\\") [0060.188] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x78, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.188] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.188] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.188] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756568 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755178 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7634e8 [0060.189] lstrcpyW (in: lpString1=0x755178, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.189] lstrcpyW (in: lpString1=0x7634e8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.189] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.189] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f78 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x763570 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f60 [0060.189] PathFindFileNameW (pszPath="desktop.ini") returned="desktop.ini" [0060.189] _wcslwr (in: _String=0x246f54c | out: _String="desktop.ini") returned="desktop.ini" [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7564f8 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755130 [0060.189] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7635d8 [0060.189] lstrcpyW (in: lpString1=0x755130, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.190] lstrcpyW (in: lpString1=0x7635d8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.190] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f48 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x763660 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f30 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756418 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755250 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7636b8 [0060.190] lstrcpyW (in: lpString1=0x755250, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.190] lstrcpyW (in: lpString1=0x7636b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.190] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.190] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f18 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x763740 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f00 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756338 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755298 [0060.190] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7637a8 [0060.190] lstrcpyW (in: lpString1=0x755298, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.190] lstrcpyW (in: lpString1=0x7637a8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.191] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ee8 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x763830 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ed0 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762908 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7552e0 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7638a8 [0060.191] lstrcpyW (in: lpString1=0x7552e0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.191] lstrcpyW (in: lpString1=0x7638a8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.191] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756eb8 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x763930 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ea0 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762940 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755328 [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763998 [0060.191] lstrcpyW (in: lpString1=0x755328, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.191] lstrcpyW (in: lpString1=0x763998, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.191] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.191] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.191] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e40 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x763a20 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e58 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762978 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755370 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763ab8 [0060.192] lstrcpyW (in: lpString1=0x755370, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.192] lstrcpyW (in: lpString1=0x763ab8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.192] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.192] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e70 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x763b40 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e88 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7629b0 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7553b8 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763bb8 [0060.192] lstrcpyW (in: lpString1=0x7553b8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.192] lstrcpyW (in: lpString1=0x763bb8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.192] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.192] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763118 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763c40 [0060.192] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763130 [0060.193] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7629e8 [0060.193] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755400 [0060.193] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763cc8 [0060.193] lstrcpyW (in: lpString1=0x755400, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.193] lstrcpyW (in: lpString1=0x763cc8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.193] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.193] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.193] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763148 [0060.193] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x763d50 [0060.193] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763160 [0060.193] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762a20 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755448 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763da8 [0060.194] lstrcpyW (in: lpString1=0x755448, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.194] lstrcpyW (in: lpString1=0x763da8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.194] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763178 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x763e30 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763190 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762a58 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755490 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763ea8 [0060.194] lstrcpyW (in: lpString1=0x755490, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.194] lstrcpyW (in: lpString1=0x763ea8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.194] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.194] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7631a8 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x763f30 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7631c0 [0060.194] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762a90 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7554d8 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x763fa8 [0060.195] lstrcpyW (in: lpString1=0x7554d8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.195] lstrcpyW (in: lpString1=0x763fa8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.195] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.195] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7631d8 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764048 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7631f0 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762ac8 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755520 [0060.195] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765030 [0060.195] lstrcpyW (in: lpString1=0x755520, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.195] lstrcpyW (in: lpString1=0x765030, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.196] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.196] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.196] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763208 [0060.196] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7640b0 [0060.196] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763220 [0060.196] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762b00 [0060.196] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755568 [0060.196] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7650d0 [0060.196] lstrcpyW (in: lpString1=0x755568, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.196] lstrcpyW (in: lpString1=0x7650d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.196] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763238 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764118 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763250 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762b38 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7555b0 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765158 [0060.197] lstrcpyW (in: lpString1=0x7555b0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.197] lstrcpyW (in: lpString1=0x765158, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.197] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763268 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7670b8 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763280 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762b70 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7555f8 [0060.197] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7651e0 [0060.197] lstrcpyW (in: lpString1=0x7555f8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.197] lstrcpyW (in: lpString1=0x7651e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.197] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.197] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763298 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767130 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7632b0 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762ba8 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755640 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765268 [0060.198] lstrcpyW (in: lpString1=0x755640, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.198] lstrcpyW (in: lpString1=0x765268, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.198] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.198] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7632c8 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x767188 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7632e0 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762be0 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755688 [0060.198] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7652f0 [0060.198] lstrcpyW (in: lpString1=0x755688, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.198] lstrcpyW (in: lpString1=0x7652f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.198] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.199] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7632f8 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x767200 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763310 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762c18 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7556d0 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765378 [0060.199] lstrcpyW (in: lpString1=0x7556d0, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0060.199] lstrcpyW (in: lpString1=0x765378, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.199] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\" | out: lpString1="\\\\?\\C:\\Program Files\\") returned="\\\\?\\C:\\Program Files\\" [0060.199] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\!!_FILES_ENCRYPTED_.txt" [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763328 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764180 [0060.199] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763340 [0060.199] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.201] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.201] LocalFree (hMem=0x758e50) returned 0x0 [0060.201] NtClose (Handle=0x78) returned 0x0 [0060.201] LocalFree (hMem=0x762020) returned 0x0 [0060.201] LocalFree (hMem=0x7551c0) returned 0x0 [0060.201] LocalFree (hMem=0x756f90) returned 0x0 [0060.201] LocalFree (hMem=0x756fa8) returned 0x0 [0060.201] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.201] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.201] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.201] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.201] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.201] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.201] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.201] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.202] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.202] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.202] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.202] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.202] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.203] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.203] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.203] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.203] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.203] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.203] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.204] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.204] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.205] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.205] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.205] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.205] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.205] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.206] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.206] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.206] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.207] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.207] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.207] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.207] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.208] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.208] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.208] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.208] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.208] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.209] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.209] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.209] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.209] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.209] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.209] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.209] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.210] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.210] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.210] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.211] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.211] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.211] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.211] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.212] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.212] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.212] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.213] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.213] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.213] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.213] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.214] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.214] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.214] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.214] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.214] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.214] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.215] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.215] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.216] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.216] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.216] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.216] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.216] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.216] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.217] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.217] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.218] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.218] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.218] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.218] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.218] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.218] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.218] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.218] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.218] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.218] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.218] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.218] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.218] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.218] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.218] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.218] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.218] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.218] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.219] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.219] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.219] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.219] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.219] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.219] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.219] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.219] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.219] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.219] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.219] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.219] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.219] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.227] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.227] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.228] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.228] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.228] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.228] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.228] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.228] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.228] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.228] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.228] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.228] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.228] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.228] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.228] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.228] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.228] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.228] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.228] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.228] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.228] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.228] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.228] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.228] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.228] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.228] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.228] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.228] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.228] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.228] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.228] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.228] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.228] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.229] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.229] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.229] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.229] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.229] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.229] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.230] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.230] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.230] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.230] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.230] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.230] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x762020 [0060.230] wsprintfW (in: param_1=0x762020, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\") returned 27 [0060.230] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\") [0060.230] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x78, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.230] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.230] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.231] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762c50 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767278 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765400 [0060.231] lstrcpyW (in: lpString1=0x767278, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.231] lstrcpyW (in: lpString1=0x765400, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.231] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.231] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756fa8 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7672d0 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f90 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762c88 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767328 [0060.231] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765488 [0060.232] lstrcpyW (in: lpString1=0x767328, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.232] lstrcpyW (in: lpString1=0x765488, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.232] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.232] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763358 [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7641e8 [0060.232] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763370 [0060.232] PathFindFileNameW (pszPath="desktop.ini") returned="desktop.ini" [0060.232] _wcslwr (in: _String=0x246f54c | out: _String="desktop.ini") returned="desktop.ini" [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762cc0 [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767380 [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765510 [0060.232] lstrcpyW (in: lpString1=0x767380, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.232] lstrcpyW (in: lpString1=0x765510, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.232] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.232] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763388 [0060.232] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764250 [0060.232] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7633a0 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762cf8 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7673d8 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765598 [0060.233] lstrcpyW (in: lpString1=0x7673d8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.233] lstrcpyW (in: lpString1=0x765598, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.233] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.233] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7633b8 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x767430 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7633d0 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762d30 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7674a8 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765620 [0060.233] lstrcpyW (in: lpString1=0x7674a8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.233] lstrcpyW (in: lpString1=0x765620, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.233] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.233] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7633e8 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767500 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763400 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762d68 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767558 [0060.233] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7656a8 [0060.233] lstrcpyW (in: lpString1=0x767558, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.234] lstrcpyW (in: lpString1=0x7656a8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.234] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.234] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763418 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765730 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763430 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762da0 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7675c8 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7657b8 [0060.234] lstrcpyW (in: lpString1=0x7675c8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.234] lstrcpyW (in: lpString1=0x7657b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.234] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.234] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763448 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7685b0 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763460 [0060.234] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762dd8 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767620 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765840 [0060.235] lstrcpyW (in: lpString1=0x767620, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.235] lstrcpyW (in: lpString1=0x765840, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.235] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763478 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7658c8 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763490 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762e10 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767678 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765950 [0060.235] lstrcpyW (in: lpString1=0x767678, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.235] lstrcpyW (in: lpString1=0x765950, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.235] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.235] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7634a8 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7642b8 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7634c0 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762e48 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7676d0 [0060.235] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7659d8 [0060.236] lstrcpyW (in: lpString1=0x7676d0, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.236] lstrcpyW (in: lpString1=0x7659d8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.236] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.236] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768640 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x768a28 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768658 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762e80 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767728 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765a60 [0060.236] lstrcpyW (in: lpString1=0x767728, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.236] lstrcpyW (in: lpString1=0x765a60, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.236] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.236] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768670 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765ae8 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768688 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762eb8 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767780 [0060.236] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765b70 [0060.236] lstrcpyW (in: lpString1=0x767780, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.236] lstrcpyW (in: lpString1=0x765b70, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.237] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7686a0 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764320 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7686b8 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762ef0 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7677d8 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765bf8 [0060.237] lstrcpyW (in: lpString1=0x7677d8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.237] lstrcpyW (in: lpString1=0x765bf8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.237] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7686d0 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x768aa0 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7686e8 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762f28 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767830 [0060.237] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765c80 [0060.237] lstrcpyW (in: lpString1=0x767830, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.237] lstrcpyW (in: lpString1=0x765c80, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.237] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.237] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768700 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x768b18 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768718 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762f60 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767888 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765d08 [0060.238] lstrcpyW (in: lpString1=0x767888, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.238] lstrcpyW (in: lpString1=0x765d08, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.238] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.238] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768730 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x768b90 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768748 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762f98 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7678e0 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765d90 [0060.238] lstrcpyW (in: lpString1=0x7678e0, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.238] lstrcpyW (in: lpString1=0x765d90, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.238] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.238] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768760 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764388 [0060.238] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768778 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x762fd0 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767938 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765e18 [0060.239] lstrcpyW (in: lpString1=0x767938, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.239] lstrcpyW (in: lpString1=0x765e18, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.239] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768790 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x768c08 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7687a8 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x763008 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767990 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765ea0 [0060.239] lstrcpyW (in: lpString1=0x767990, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.239] lstrcpyW (in: lpString1=0x765ea0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.239] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.239] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7687c0 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7643f0 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7687d8 [0060.239] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x763040 [0060.240] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7679e8 [0060.240] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765f28 [0060.240] lstrcpyW (in: lpString1=0x7679e8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.240] lstrcpyW (in: lpString1=0x765f28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.240] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.240] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.240] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7687f0 [0060.240] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x768c80 [0060.240] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768808 [0060.240] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768d10 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767a40 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765fb0 [0060.241] lstrcpyW (in: lpString1=0x767a40, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.241] lstrcpyW (in: lpString1=0x765fb0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.241] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768820 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766038 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768838 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768d48 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767a98 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7660c0 [0060.241] lstrcpyW (in: lpString1=0x767a98, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0060.241] lstrcpyW (in: lpString1=0x7660c0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.241] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\") returned="\\\\?\\C:\\Program Files (x86)\\" [0060.241] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\!!_FILES_ENCRYPTED_.txt" [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768850 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7694f8 [0060.241] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768868 [0060.241] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.242] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.242] LocalFree (hMem=0x758e50) returned 0x0 [0060.242] NtClose (Handle=0x78) returned 0x0 [0060.242] LocalFree (hMem=0x762020) returned 0x0 [0060.242] LocalFree (hMem=0x762630) returned 0x0 [0060.242] LocalFree (hMem=0x756fc0) returned 0x0 [0060.242] LocalFree (hMem=0x756fd8) returned 0x0 [0060.242] StrCpyNW (in: psz1=0x757544, psz2="C:\\ProgramData\\", cchMax=252 | out: psz1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.242] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.242] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.242] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.242] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.242] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.242] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.242] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.242] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.242] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.242] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.242] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.243] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.243] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.243] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.243] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.243] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.244] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.244] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.244] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.244] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.245] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.245] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.245] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.245] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.245] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.246] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.246] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.246] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.246] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.246] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.246] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.247] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.247] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.247] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.247] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.247] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.247] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.248] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.248] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.248] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.249] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.249] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.249] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.249] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.249] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.249] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.250] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.250] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.250] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.251] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.251] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.251] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.251] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.251] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.251] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.252] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.252] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.252] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.252] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.252] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.252] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.253] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.253] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.253] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.253] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.253] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.253] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.254] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.254] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.254] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.254] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.254] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.254] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.254] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.254] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.254] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.254] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.254] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.254] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.254] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.254] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.254] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.255] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.255] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.255] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.255] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.256] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.256] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.256] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.256] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.256] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.256] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.256] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.256] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.256] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.256] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.256] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.256] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.256] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.257] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.257] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.257] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.257] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.257] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.257] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.258] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.258] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.258] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.259] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.259] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.259] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.259] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.259] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.259] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.260] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.260] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.260] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.260] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.260] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.260] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.261] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.261] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.261] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.261] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.261] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.261] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.262] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.262] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.262] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.262] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.262] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.262] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.263] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.263] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.263] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.263] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.263] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.263] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.264] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.264] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.264] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.264] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.264] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.264] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.264] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7551c0 [0060.264] wsprintfW (in: param_1=0x7551c0, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\ProgramData\\") returned 19 [0060.264] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\ProgramData\\" | out: DestinationString="\\??\\C:\\ProgramData\\") [0060.264] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x78, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.264] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.264] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.265] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.265] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768d80 [0060.265] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755718 [0060.265] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769570 [0060.265] lstrcpyW (in: lpString1=0x755718, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.265] lstrcpyW (in: lpString1=0x769570, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.265] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.265] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.265] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756fd8 [0060.265] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755760 [0060.265] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756fc0 [0060.265] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768db8 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7557a8 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769600 [0060.266] lstrcpyW (in: lpString1=0x7557a8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.266] lstrcpyW (in: lpString1=0x769600, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.266] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.266] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768880 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764458 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768898 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768df0 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7557f0 [0060.266] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769678 [0060.266] lstrcpyW (in: lpString1=0x7557f0, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.266] lstrcpyW (in: lpString1=0x769678, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.266] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.266] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7688b0 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767af0 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7688c8 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768e28 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755838 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7696f0 [0060.267] lstrcpyW (in: lpString1=0x755838, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.267] lstrcpyW (in: lpString1=0x7696f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.267] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.267] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7688e0 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767b48 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7688f8 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768e60 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755880 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769768 [0060.267] lstrcpyW (in: lpString1=0x755880, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.267] lstrcpyW (in: lpString1=0x769768, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.267] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.267] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768910 [0060.267] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767ba0 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768928 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768e98 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7558c8 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7697e0 [0060.268] lstrcpyW (in: lpString1=0x7558c8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.268] lstrcpyW (in: lpString1=0x7697e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.268] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.268] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768940 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767bf8 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768958 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768ed0 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755910 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769858 [0060.268] lstrcpyW (in: lpString1=0x755910, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.268] lstrcpyW (in: lpString1=0x769858, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.268] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.268] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768970 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7644c0 [0060.268] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768988 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768f08 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755958 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7698d0 [0060.269] lstrcpyW (in: lpString1=0x755958, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.269] lstrcpyW (in: lpString1=0x7698d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.269] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.269] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7689a0 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767c50 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7689b8 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768f40 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7559a0 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769948 [0060.269] lstrcpyW (in: lpString1=0x7559a0, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.269] lstrcpyW (in: lpString1=0x769948, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.269] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.269] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7689d0 [0060.269] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767ca8 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7689e8 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768f78 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7559e8 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7699c0 [0060.270] lstrcpyW (in: lpString1=0x7559e8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.270] lstrcpyW (in: lpString1=0x7699c0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.270] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.270] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768a00 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767d00 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a600 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768fb0 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755a30 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769a38 [0060.270] lstrcpyW (in: lpString1=0x755a30, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.270] lstrcpyW (in: lpString1=0x769a38, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.270] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.270] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a618 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767d58 [0060.270] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a630 [0060.271] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x768fe8 [0060.271] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755a78 [0060.271] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769ab0 [0060.271] lstrcpyW (in: lpString1=0x755a78, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.271] lstrcpyW (in: lpString1=0x769ab0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.271] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.271] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.271] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a648 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755ac0 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a660 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769020 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755b08 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769b28 [0060.272] lstrcpyW (in: lpString1=0x755b08, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0060.272] lstrcpyW (in: lpString1=0x769b28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.272] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\ProgramData\\" | out: lpString1="\\\\?\\C:\\ProgramData\\") returned="\\\\?\\C:\\ProgramData\\" [0060.272] lstrcatW (in: lpString1="\\\\?\\C:\\ProgramData\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\ProgramData\\!!_FILES_ENCRYPTED_.txt" [0060.272] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a678 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767db0 [0060.272] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a690 [0060.272] NtQueryDirectoryFile (in: FileHandle=0x78, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.272] NtWaitForSingleObject (Object=0x78, Alertable=0, Time=0x0) returned 0x0 [0060.272] LocalFree (hMem=0x758e50) returned 0x0 [0060.273] NtClose (Handle=0x78) returned 0x0 [0060.273] LocalFree (hMem=0x7551c0) returned 0x0 [0060.273] LocalFree (hMem=0x755208) returned 0x0 [0060.273] LocalFree (hMem=0x756ff0) returned 0x0 [0060.273] LocalFree (hMem=0x757008) returned 0x0 [0060.273] StrCpyNW (in: psz1=0x757544, psz2="C:\\Recovery\\", cchMax=252 | out: psz1="C:\\Recovery\\") returned="C:\\Recovery\\" [0060.273] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.273] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.273] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.273] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.273] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.273] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.273] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.274] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.274] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.274] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.274] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.274] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.274] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.275] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.275] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.275] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.275] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.276] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.276] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.276] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.276] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.276] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.276] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.277] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.277] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.277] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.277] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.277] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.278] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.278] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.278] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.279] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.279] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.279] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.279] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.279] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.280] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.280] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.280] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.280] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.280] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.281] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.281] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.281] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.281] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.281] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.282] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.282] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.282] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.282] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.282] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.282] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.283] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.283] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.283] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.283] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.283] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.283] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.284] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.284] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.284] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.284] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.284] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.284] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.285] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.285] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.285] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.285] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.285] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.286] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.286] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.286] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.287] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.287] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.287] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.287] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.287] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.287] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.287] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.287] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.288] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.288] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.288] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.288] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.288] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.288] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.289] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.289] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.289] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.289] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.289] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.289] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.290] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.290] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.290] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.290] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.290] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.290] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.290] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.291] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.291] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.291] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.292] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.292] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.292] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.292] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.292] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.293] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.293] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.293] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.293] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.293] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.293] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.294] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.294] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.294] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.294] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.294] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.294] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.295] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755208 [0060.295] wsprintfW (in: param_1=0x755208, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Recovery\\") returned 16 [0060.295] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Recovery\\" | out: DestinationString="\\??\\C:\\Recovery\\") [0060.295] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Recovery\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.307] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.307] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.308] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.308] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769058 [0060.308] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769090 [0060.308] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769ba0 [0060.308] lstrcpyW (in: lpString1=0x769090, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0060.308] lstrcpyW (in: lpString1=0x769ba0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.308] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Recovery\\" | out: lpString1="\\\\?\\C:\\Recovery\\") returned="\\\\?\\C:\\Recovery\\" [0060.308] lstrcatW (in: lpString1="\\\\?\\C:\\Recovery\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Recovery\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Recovery\\!!_FILES_ENCRYPTED_.txt" [0060.308] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757008 [0060.308] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766148 [0060.308] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ff0 [0060.308] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.309] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.309] LocalFree (hMem=0x758e50) returned 0x0 [0060.309] NtClose (Handle=0x7c) returned 0x0 [0060.309] LocalFree (hMem=0x755208) returned 0x0 [0060.309] LocalFree (hMem=0x756680) returned 0x0 [0060.309] LocalFree (hMem=0x757020) returned 0x0 [0060.309] LocalFree (hMem=0x757038) returned 0x0 [0060.309] StrCpyNW (in: psz1=0x757544, psz2="C:\\System Volume Information\\", cchMax=252 | out: psz1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0060.309] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.309] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.309] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.309] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.309] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.309] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.309] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.309] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.309] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.309] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.310] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.310] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.310] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.311] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.311] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.311] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.312] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.312] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.312] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.312] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.312] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.312] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.313] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.313] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.314] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.314] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.314] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.314] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.314] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.314] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.314] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.315] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.315] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.316] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.316] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.316] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.316] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.316] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.316] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.317] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.317] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.318] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.318] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.318] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.319] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.319] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.319] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.319] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.320] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.320] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.321] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.321] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.321] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.321] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.321] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.321] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.322] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.322] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.323] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.323] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.323] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.323] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.324] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.324] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.324] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.324] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.324] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.324] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.324] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.324] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.324] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.324] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.324] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.324] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.324] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.325] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.325] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.326] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.326] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.326] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.326] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.326] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.326] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.327] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.327] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.328] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.328] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.328] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.328] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.329] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.329] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.329] LocalFree (hMem=0x7627c0) returned 0x0 [0060.330] LocalFree (hMem=0x757050) returned 0x0 [0060.330] LocalFree (hMem=0x757068) returned 0x0 [0060.330] StrCpyNW (in: psz1=0x757544, psz2="C:\\Users\\", cchMax=252 | out: psz1="C:\\Users\\") returned="C:\\Users\\" [0060.330] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755208 [0060.330] wsprintfW (in: param_1=0x755208, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Users\\") returned 13 [0060.330] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Users\\" | out: DestinationString="\\??\\C:\\Users\\") [0060.330] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.330] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.330] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.330] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756680 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7690c8 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769c18 [0060.331] lstrcpyW (in: lpString1=0x7690c8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0060.331] lstrcpyW (in: lpString1=0x769c18, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.331] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0060.331] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757068 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764528 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757050 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769100 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769138 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769c90 [0060.331] lstrcpyW (in: lpString1=0x769138, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0060.331] lstrcpyW (in: lpString1=0x769c90, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.331] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0060.331] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757038 [0060.331] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x7551c0 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757020 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769170 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7691a8 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769d08 [0060.332] lstrcpyW (in: lpString1=0x7691a8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0060.332] lstrcpyW (in: lpString1=0x769d08, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.332] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0060.332] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a6a8 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755b50 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a6c0 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7691e0 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769218 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769d80 [0060.332] lstrcpyW (in: lpString1=0x769218, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0060.332] lstrcpyW (in: lpString1=0x769d80, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.332] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0060.332] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a6d8 [0060.332] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767e08 [0060.333] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a6f0 [0060.333] PathFindFileNameW (pszPath="desktop.ini") returned="desktop.ini" [0060.333] _wcslwr (in: _String=0x246f54c | out: _String="desktop.ini") returned="desktop.ini" [0060.333] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769250 [0060.333] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769288 [0060.333] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769df8 [0060.333] lstrcpyW (in: lpString1=0x769288, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0060.333] lstrcpyW (in: lpString1=0x769df8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.333] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Users\\" | out: lpString1="\\\\?\\C:\\Users\\") returned="\\\\?\\C:\\Users\\" [0060.333] lstrcatW (in: lpString1="\\\\?\\C:\\Users\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Users\\!!_FILES_ENCRYPTED_.txt" [0060.333] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a708 [0060.333] LocalAlloc (uFlags=0x40, uBytes=0x40) returned 0x755b98 [0060.333] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a720 [0060.333] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.334] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.334] LocalFree (hMem=0x758e50) returned 0x0 [0060.334] NtClose (Handle=0x7c) returned 0x0 [0060.334] LocalFree (hMem=0x755208) returned 0x0 [0060.334] LocalFree (hMem=0x756728) returned 0x0 [0060.334] LocalFree (hMem=0x757080) returned 0x0 [0060.334] LocalFree (hMem=0x757098) returned 0x0 [0060.334] StrCpyNW (in: psz1=0x757544, psz2="C:\\Windows\\", cchMax=252 | out: psz1="C:\\Windows\\") returned="C:\\Windows\\" [0060.334] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.334] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.334] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.334] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.334] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.334] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.334] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.334] RtlUpcaseUnicodeChar (Source=0x57) returned 0x57 [0060.334] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.335] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.335] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.335] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.335] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.335] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.335] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.335] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.335] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.335] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.335] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.335] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.335] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.335] LocalFree (hMem=0x7628d0) returned 0x0 [0060.335] LocalFree (hMem=0x7570b0) returned 0x0 [0060.335] LocalFree (hMem=0x763100) returned 0x0 [0060.335] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Common Files\\", cchMax=252 | out: psz1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0060.335] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.335] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.335] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.335] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.335] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.335] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.335] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.336] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.336] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.336] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.336] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.336] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.337] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.337] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.337] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.337] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.338] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.338] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.338] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.338] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.338] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.338] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.339] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.339] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.340] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.340] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.340] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.340] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.341] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.341] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.341] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.341] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.342] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.342] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.342] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.342] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.343] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.343] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.343] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.344] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.344] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.344] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.344] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.345] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.345] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.345] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.345] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.345] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.345] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.346] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.346] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.346] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.346] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.347] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.347] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.347] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.347] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.347] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.347] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.348] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.348] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.348] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.348] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.349] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.350] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.350] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.350] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.350] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.350] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.350] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.351] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.351] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.351] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.351] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.352] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.352] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.352] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.352] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.352] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.352] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.353] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.353] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.353] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.353] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.353] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.353] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.353] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.353] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.353] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.353] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.353] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.353] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.353] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.353] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.354] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.354] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.354] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.354] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.354] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.354] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.354] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.354] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.354] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.354] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.354] LocalFree (hMem=0x763570) returned 0x0 [0060.354] LocalFree (hMem=0x756f78) returned 0x0 [0060.354] LocalFree (hMem=0x756f60) returned 0x0 [0060.354] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\DVD Maker\\", cchMax=252 | out: psz1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0060.354] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.354] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.354] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.354] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.354] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.354] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.354] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.354] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.354] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.355] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.355] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.356] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.356] RtlUpcaseUnicodeChar (Source=0x56) returned 0x56 [0060.356] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.356] RtlUpcaseUnicodeChar (Source=0x44) returned 0x44 [0060.356] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.356] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.356] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.356] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764590 [0060.356] wsprintfW (in: param_1=0x764590, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\DVD Maker\\") returned 31 [0060.356] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\DVD Maker\\" | out: DestinationString="\\??\\C:\\Program Files\\DVD Maker\\") [0060.356] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\DVD Maker\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.356] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.356] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.357] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.357] PathFindFileNameW (pszPath="aldelo.exe") returned="aldelo.exe" [0060.357] _wcslwr (in: _String=0x246f54c | out: _String="aldelo.exe") returned="aldelo.exe" [0060.357] PathFindExtensionW (pszPath="aldelo.exe") returned=".exe" [0060.357] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.357] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.357] PathFindFileNameW (pszPath="audiodepthconverter.ax") returned="audiodepthconverter.ax" [0060.357] _wcslwr (in: _String=0x246f54c | out: _String="audiodepthconverter.ax") returned="audiodepthconverter.ax" [0060.357] PathFindExtensionW (pszPath="audiodepthconverter.ax") returned=".ax" [0060.357] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.357] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.357] PathFindFileNameW (pszPath="bod_r.TTF") returned="bod_r.TTF" [0060.357] _wcslwr (in: _String=0x246f54c | out: _String="bod_r.ttf") returned="bod_r.ttf" [0060.358] PathFindExtensionW (pszPath="bod_r.TTF") returned=".TTF" [0060.358] lstrcatW (in: lpString1="", lpString2="TTF" | out: lpString1="TTF") returned="TTF" [0060.358] _wcslwr (in: _String=0x762078 | out: _String="ttf") returned="ttf" [0060.358] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7628d0 [0060.358] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767e60 [0060.358] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7661d0 [0060.358] lstrcpyW (in: lpString1=0x767e60, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0060.358] lstrcpyW (in: lpString1=0x7661d0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.358] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0060.358] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="bod_r.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" [0060.358] PathFindFileNameW (pszPath="directshowtap.ax") returned="directshowtap.ax" [0060.358] _wcslwr (in: _String=0x246f54c | out: _String="directshowtap.ax") returned="directshowtap.ax" [0060.358] PathFindExtensionW (pszPath="directshowtap.ax") returned=".ax" [0060.358] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.358] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.358] PathFindFileNameW (pszPath="DVDMaker.exe") returned="DVDMaker.exe" [0060.358] _wcslwr (in: _String=0x246f54c | out: _String="dvdmaker.exe") returned="dvdmaker.exe" [0060.358] PathFindExtensionW (pszPath="DVDMaker.exe") returned=".exe" [0060.358] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.358] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.358] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7692c0 [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767eb8 [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76abf8 [0060.359] lstrcpyW (in: lpString1=0x767eb8, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0060.359] lstrcpyW (in: lpString1=0x76abf8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.359] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0060.359] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\!!_FILES_ENCRYPTED_.txt" [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f60 [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7645f8 [0060.359] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f78 [0060.359] PathFindFileNameW (pszPath="Eurosti.TTF") returned="Eurosti.TTF" [0060.359] _wcslwr (in: _String=0x246f54c | out: _String="eurosti.ttf") returned="eurosti.ttf" [0060.359] PathFindExtensionW (pszPath="Eurosti.TTF") returned=".TTF" [0060.359] lstrcatW (in: lpString1="", lpString2="TTF" | out: lpString1="TTF") returned="TTF" [0060.359] _wcslwr (in: _String=0x762078 | out: _String="ttf") returned="ttf" [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7692f8 [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767f10 [0060.359] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76ac90 [0060.359] lstrcpyW (in: lpString1=0x767f10, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0060.359] lstrcpyW (in: lpString1=0x76ac90, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.359] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0060.359] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="Eurosti.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" [0060.359] PathFindFileNameW (pszPath="fieldswitch.ax") returned="fieldswitch.ax" [0060.359] _wcslwr (in: _String=0x246f54c | out: _String="fieldswitch.ax") returned="fieldswitch.ax" [0060.360] PathFindExtensionW (pszPath="fieldswitch.ax") returned=".ax" [0060.360] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.360] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.360] PathFindFileNameW (pszPath="offset.ax") returned="offset.ax" [0060.360] _wcslwr (in: _String=0x246f54c | out: _String="offset.ax") returned="offset.ax" [0060.360] PathFindExtensionW (pszPath="offset.ax") returned=".ax" [0060.360] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.360] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.360] PathFindFileNameW (pszPath="OmdBase.dll") returned="OmdBase.dll" [0060.360] _wcslwr (in: _String=0x246f54c | out: _String="omdbase.dll") returned="omdbase.dll" [0060.360] PathFindExtensionW (pszPath="OmdBase.dll") returned=".dll" [0060.360] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.360] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.360] PathFindFileNameW (pszPath="OmdProject.dll") returned="OmdProject.dll" [0060.360] _wcslwr (in: _String=0x246f54c | out: _String="omdproject.dll") returned="omdproject.dll" [0060.360] PathFindExtensionW (pszPath="OmdProject.dll") returned=".dll" [0060.360] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.360] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.361] PathFindFileNameW (pszPath="Pipeline.dll") returned="Pipeline.dll" [0060.361] _wcslwr (in: _String=0x246f54c | out: _String="pipeline.dll") returned="pipeline.dll" [0060.361] PathFindExtensionW (pszPath="Pipeline.dll") returned=".dll" [0060.361] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.361] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.361] PathFindFileNameW (pszPath="PipeTran.dll") returned="PipeTran.dll" [0060.361] _wcslwr (in: _String=0x246f54c | out: _String="pipetran.dll") returned="pipetran.dll" [0060.361] PathFindExtensionW (pszPath="PipeTran.dll") returned=".dll" [0060.361] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.361] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.361] PathFindFileNameW (pszPath="rtstreamsink.ax") returned="rtstreamsink.ax" [0060.361] _wcslwr (in: _String=0x246f54c | out: _String="rtstreamsink.ax") returned="rtstreamsink.ax" [0060.361] PathFindExtensionW (pszPath="rtstreamsink.ax") returned=".ax" [0060.361] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.361] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.361] PathFindFileNameW (pszPath="rtstreamsource.ax") returned="rtstreamsource.ax" [0060.361] _wcslwr (in: _String=0x246f54c | out: _String="rtstreamsource.ax") returned="rtstreamsource.ax" [0060.361] PathFindExtensionW (pszPath="rtstreamsource.ax") returned=".ax" [0060.361] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.361] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.362] PathFindFileNameW (pszPath="SecretST.TTF") returned="SecretST.TTF" [0060.362] _wcslwr (in: _String=0x246f54c | out: _String="secretst.ttf") returned="secretst.ttf" [0060.362] PathFindExtensionW (pszPath="SecretST.TTF") returned=".TTF" [0060.362] lstrcatW (in: lpString1="", lpString2="TTF" | out: lpString1="TTF") returned="TTF" [0060.362] _wcslwr (in: _String=0x762078 | out: _String="ttf") returned="ttf" [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769330 [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767f68 [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76ad28 [0060.362] lstrcpyW (in: lpString1=0x767f68, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0060.362] lstrcpyW (in: lpString1=0x76ad28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.362] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0060.362] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="SecretST.TTF" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769368 [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x767fc0 [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76adc0 [0060.362] lstrcpyW (in: lpString1=0x767fc0, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0060.362] lstrcpyW (in: lpString1=0x76adc0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.362] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\") returned="\\\\?\\C:\\Program Files\\DVD Maker\\" [0060.362] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\DVD Maker\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\DVD Maker\\!!_FILES_ENCRYPTED_.txt" [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7570b0 [0060.362] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764660 [0060.362] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x757098 [0060.363] PathFindFileNameW (pszPath="soniccolorconverter.ax") returned="soniccolorconverter.ax" [0060.363] _wcslwr (in: _String=0x246f54c | out: _String="soniccolorconverter.ax") returned="soniccolorconverter.ax" [0060.363] PathFindExtensionW (pszPath="soniccolorconverter.ax") returned=".ax" [0060.363] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.363] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.363] PathFindFileNameW (pszPath="sonicsptransform.ax") returned="sonicsptransform.ax" [0060.363] _wcslwr (in: _String=0x246f54c | out: _String="sonicsptransform.ax") returned="sonicsptransform.ax" [0060.363] PathFindExtensionW (pszPath="sonicsptransform.ax") returned=".ax" [0060.363] lstrcatW (in: lpString1="", lpString2="ax" | out: lpString1="ax") returned="ax" [0060.363] _wcslwr (in: _String=0x762078 | out: _String="ax") returned="ax" [0060.363] PathFindFileNameW (pszPath="technology.exe") returned="technology.exe" [0060.363] _wcslwr (in: _String=0x246f54c | out: _String="technology.exe") returned="technology.exe" [0060.363] PathFindExtensionW (pszPath="technology.exe") returned=".exe" [0060.363] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.363] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.363] PathFindFileNameW (pszPath="trillian.exe") returned="trillian.exe" [0060.363] _wcslwr (in: _String=0x246f54c | out: _String="trillian.exe") returned="trillian.exe" [0060.364] PathFindExtensionW (pszPath="trillian.exe") returned=".exe" [0060.364] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.364] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.364] PathFindFileNameW (pszPath="WMM2CLIP.dll") returned="WMM2CLIP.dll" [0060.364] _wcslwr (in: _String=0x246f54c | out: _String="wmm2clip.dll") returned="wmm2clip.dll" [0060.364] PathFindExtensionW (pszPath="WMM2CLIP.dll") returned=".dll" [0060.364] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.364] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.364] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.364] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.364] LocalFree (hMem=0x758e50) returned 0x0 [0060.364] NtClose (Handle=0x7c) returned 0x0 [0060.365] LocalFree (hMem=0x764590) returned 0x0 [0060.365] LocalFree (hMem=0x763660) returned 0x0 [0060.365] LocalFree (hMem=0x756f48) returned 0x0 [0060.365] LocalFree (hMem=0x756f30) returned 0x0 [0060.365] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Internet Explorer\\", cchMax=252 | out: psz1="C:\\Program Files\\Internet Explorer\\") returned="C:\\Program Files\\Internet Explorer\\" [0060.365] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.365] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.365] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.365] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.365] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.365] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.365] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.366] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.366] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.367] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.367] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.367] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.367] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.367] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.368] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.368] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.368] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.368] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.369] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.369] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.370] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.370] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.370] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.370] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.370] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.371] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.371] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.371] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.371] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.372] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.372] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.372] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.373] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.373] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.373] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.373] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.374] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.374] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.374] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.374] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.375] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.375] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.375] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.375] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.375] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.375] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.376] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.376] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.376] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.376] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.377] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.377] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.378] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.378] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.378] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.378] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.378] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.378] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.379] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.379] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.379] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.379] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.380] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.380] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.381] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.381] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.381] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.381] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.381] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.381] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.382] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.382] RtlUpcaseUnicodeChar (Source=0x49) returned 0x49 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.382] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.382] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.383] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.384] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.384] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.384] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.384] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.384] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.384] LocalFree (hMem=0x763740) returned 0x0 [0060.384] LocalFree (hMem=0x756f18) returned 0x0 [0060.384] LocalFree (hMem=0x756f00) returned 0x0 [0060.384] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Microsoft Analysis Services\\", cchMax=252 | out: psz1="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0060.384] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766258 [0060.384] wsprintfW (in: param_1=0x766258, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Microsoft Analysis Services\\") returned 49 [0060.384] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Microsoft Analysis Services\\" | out: DestinationString="\\??\\C:\\Program Files\\Microsoft Analysis Services\\") [0060.385] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Microsoft Analysis Services\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.385] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.385] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.385] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.385] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7693a0 [0060.385] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769e70 [0060.385] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x76ae58 [0060.385] lstrcpyW (in: lpString1=0x769e70, lpString2="C:\\Program Files\\Microsoft Analysis Services\\" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0060.386] lstrcpyW (in: lpString1=0x76ae58, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.386] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Analysis Services\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\" [0060.386] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\!!_FILES_ENCRYPTED_.txt" [0060.386] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f00 [0060.386] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76af10 [0060.386] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f18 [0060.386] PathFindFileNameW (pszPath="ncftp.exe") returned="ncftp.exe" [0060.386] _wcslwr (in: _String=0x246f54c | out: _String="ncftp.exe") returned="ncftp.exe" [0060.386] PathFindExtensionW (pszPath="ncftp.exe") returned=".exe" [0060.386] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.386] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.386] PathFindFileNameW (pszPath="sporting interference.exe") returned="sporting interference.exe" [0060.386] _wcslwr (in: _String=0x246f54c | out: _String="sporting interference.exe") returned="sporting interference.exe" [0060.386] PathFindExtensionW (pszPath="sporting interference.exe") returned=".exe" [0060.386] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.386] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.386] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.387] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.387] LocalFree (hMem=0x758e50) returned 0x0 [0060.387] NtClose (Handle=0x7c) returned 0x0 [0060.387] LocalFree (hMem=0x766258) returned 0x0 [0060.387] LocalFree (hMem=0x763830) returned 0x0 [0060.387] LocalFree (hMem=0x756ee8) returned 0x0 [0060.387] LocalFree (hMem=0x756ed0) returned 0x0 [0060.387] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Microsoft Office\\", cchMax=252 | out: psz1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.387] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.387] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.387] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.387] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.387] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.387] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.387] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.387] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.387] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.387] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.387] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.387] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.387] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.387] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.387] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.388] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.388] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.389] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.389] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.389] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.390] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.390] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.390] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.390] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.390] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.390] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.390] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.390] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.390] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.390] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.390] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.390] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.390] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.391] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.391] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.392] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.392] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.392] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.393] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.393] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.393] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.393] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.394] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.394] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.394] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.394] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.395] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.396] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.396] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.396] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.396] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.396] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.396] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.397] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.397] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.398] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.398] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.398] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.399] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.399] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.399] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.400] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.400] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.400] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.400] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.401] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.401] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.401] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.401] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.402] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.402] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.402] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.403] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.403] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.403] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.403] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.404] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.404] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.404] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.404] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.405] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.405] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.405] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.406] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.406] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.406] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.407] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.407] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x4f) returned 0x4f [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.407] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.407] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.408] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.408] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.408] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.408] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.408] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.408] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.409] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.409] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.409] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.409] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.409] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.409] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.409] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769ee8 [0060.409] wsprintfW (in: param_1=0x769ee8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Microsoft Office\\") returned 38 [0060.409] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Microsoft Office\\" | out: DestinationString="\\??\\C:\\Program Files\\Microsoft Office\\") [0060.409] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Microsoft Office\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.409] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.409] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.413] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.413] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7693d8 [0060.413] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764590 [0060.413] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76afa8 [0060.414] lstrcpyW (in: lpString1=0x764590, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.414] lstrcpyW (in: lpString1=0x76afa8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.414] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0060.414] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ed0 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769f60 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756ee8 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769410 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7646c8 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76b050 [0060.414] lstrcpyW (in: lpString1=0x7646c8, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.414] lstrcpyW (in: lpString1=0x76b050, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.414] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0060.414] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f30 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766258 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756f48 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769448 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764730 [0060.414] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76b0f8 [0060.414] lstrcpyW (in: lpString1=0x764730, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.415] lstrcpyW (in: lpString1=0x76b0f8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.415] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0060.415] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x757080 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769fd8 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a738 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x769480 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764798 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76b1a0 [0060.415] lstrcpyW (in: lpString1=0x764798, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.415] lstrcpyW (in: lpString1=0x76b1a0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.415] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0060.415] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a750 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a050 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a768 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7694b8 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764800 [0060.415] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76b248 [0060.415] lstrcpyW (in: lpString1=0x764800, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.415] lstrcpyW (in: lpString1=0x76b248, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.416] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0060.416] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.416] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a780 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a0c8 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a798 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x756728 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764868 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76b2f0 [0060.416] lstrcpyW (in: lpString1=0x764868, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0060.416] lstrcpyW (in: lpString1=0x76b2f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.416] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\" [0060.416] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.416] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a7b0 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a140 [0060.416] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a7c8 [0060.416] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.416] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.417] LocalFree (hMem=0x758e50) returned 0x0 [0060.417] NtClose (Handle=0x7c) returned 0x0 [0060.417] LocalFree (hMem=0x769ee8) returned 0x0 [0060.417] LocalFree (hMem=0x763930) returned 0x0 [0060.417] LocalFree (hMem=0x756eb8) returned 0x0 [0060.417] LocalFree (hMem=0x756ea0) returned 0x0 [0060.417] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", cchMax=252 | out: psz1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0060.417] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.417] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.417] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.417] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.417] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.417] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.417] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.417] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.417] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.417] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.417] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.418] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.418] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.419] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.419] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.419] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.419] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x51) returned 0x51 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.420] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.420] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.421] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.421] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.421] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.421] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.422] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.422] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.422] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.422] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.423] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.423] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.423] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.423] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.423] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.423] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.423] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.423] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.423] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.423] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.424] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.424] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x51) returned 0x51 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.425] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.425] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.426] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.426] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.427] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.427] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.428] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.428] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.428] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.428] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.428] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.428] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.429] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.429] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.429] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.430] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.430] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x51) returned 0x51 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.431] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.431] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.432] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.432] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.433] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.433] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.433] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.433] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.433] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.433] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.434] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.434] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.435] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.435] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.435] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.435] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x51) returned 0x51 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.436] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.436] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x45) returned 0x45 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.437] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.437] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.438] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.438] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.438] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.438] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.438] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.439] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.439] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.440] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.440] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.440] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.440] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x51) returned 0x51 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x4c) returned 0x4c [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.441] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.441] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76b398 [0060.441] wsprintfW (in: param_1=0x76b398, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned 58 [0060.441] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: DestinationString="\\??\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\") [0060.442] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.442] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.442] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.442] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.443] PathFindFileNameW (pszPath="bitkinex.exe") returned="bitkinex.exe" [0060.443] _wcslwr (in: _String=0x246f54c | out: _String="bitkinex.exe") returned="bitkinex.exe" [0060.443] PathFindExtensionW (pszPath="bitkinex.exe") returned=".exe" [0060.443] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.443] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.443] PathFindFileNameW (pszPath="foxmailincmail.exe") returned="foxmailincmail.exe" [0060.443] _wcslwr (in: _String=0x246f54c | out: _String="foxmailincmail.exe") returned="foxmailincmail.exe" [0060.443] PathFindExtensionW (pszPath="foxmailincmail.exe") returned=".exe" [0060.443] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.443] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.443] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b448 [0060.443] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76bc30 [0060.444] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x76bcc8 [0060.444] lstrcpyW (in: lpString1=0x76bc30, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0060.444] lstrcpyW (in: lpString1=0x76bcc8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.444] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0060.444] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\!!_FILES_ENCRYPTED_.txt" [0060.444] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756ea0 [0060.444] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76bd90 [0060.444] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756eb8 [0060.444] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.444] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.444] LocalFree (hMem=0x758e50) returned 0x0 [0060.444] NtClose (Handle=0x7c) returned 0x0 [0060.445] LocalFree (hMem=0x76b398) returned 0x0 [0060.445] LocalFree (hMem=0x763a20) returned 0x0 [0060.445] LocalFree (hMem=0x756e40) returned 0x0 [0060.445] LocalFree (hMem=0x756e58) returned 0x0 [0060.445] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Microsoft Sync Framework\\", cchMax=252 | out: psz1="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0060.445] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.445] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.445] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.445] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.445] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.445] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.445] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.445] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.445] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.445] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.445] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.445] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.446] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.446] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.447] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.447] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.447] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.447] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.448] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.448] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.448] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.448] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.449] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.449] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.449] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.449] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.449] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.449] RtlUpcaseUnicodeChar (Source=0x6b) returned 0x4b [0060.449] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.449] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.449] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.449] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.449] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.449] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.449] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.449] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.449] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.449] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.450] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.450] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.451] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.451] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x6b) returned 0x4b [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.452] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.452] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.452] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.453] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.453] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.453] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.453] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.454] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.454] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.454] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.454] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.455] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.455] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x6b) returned 0x4b [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.456] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.456] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.456] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.456] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.457] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.457] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.457] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.457] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.458] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.458] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.458] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.458] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.459] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.459] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x6b) returned 0x4b [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.460] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.460] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.460] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.460] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.460] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.460] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.461] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.462] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.462] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.462] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.462] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x6b) returned 0x4b [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.463] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.464] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.464] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.464] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.464] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.464] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.464] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.465] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.465] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.466] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.466] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.466] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.466] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.467] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.467] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.468] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.468] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.469] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7662e0 [0060.469] wsprintfW (in: param_1=0x7662e0, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Microsoft Sync Framework\\") returned 46 [0060.469] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Microsoft Sync Framework\\" | out: DestinationString="\\??\\C:\\Program Files\\Microsoft Sync Framework\\") [0060.469] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Microsoft Sync Framework\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.469] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.469] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.470] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.470] PathFindFileNameW (pszPath="equally.exe") returned="equally.exe" [0060.470] _wcslwr (in: _String=0x246f54c | out: _String="equally.exe") returned="equally.exe" [0060.470] PathFindExtensionW (pszPath="equally.exe") returned=".exe" [0060.470] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.470] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.470] PathFindFileNameW (pszPath="lots_prizes.exe") returned="lots_prizes.exe" [0060.470] _wcslwr (in: _String=0x246f54c | out: _String="lots_prizes.exe") returned="lots_prizes.exe" [0060.470] PathFindExtensionW (pszPath="lots_prizes.exe") returned=".exe" [0060.470] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.470] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.471] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b480 [0060.471] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x769ee8 [0060.471] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x76be28 [0060.471] lstrcpyW (in: lpString1=0x769ee8, lpString2="C:\\Program Files\\Microsoft Sync Framework\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0060.471] lstrcpyW (in: lpString1=0x76be28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.471] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Sync Framework\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\") returned="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\" [0060.471] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\!!_FILES_ENCRYPTED_.txt" [0060.471] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e58 [0060.471] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766368 [0060.471] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e40 [0060.471] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.472] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.472] LocalFree (hMem=0x758e50) returned 0x0 [0060.472] NtClose (Handle=0x7c) returned 0x0 [0060.472] LocalFree (hMem=0x7662e0) returned 0x0 [0060.472] LocalFree (hMem=0x763b40) returned 0x0 [0060.472] LocalFree (hMem=0x756e70) returned 0x0 [0060.472] LocalFree (hMem=0x756e88) returned 0x0 [0060.472] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Microsoft Synchronization Services\\", cchMax=252 | out: psz1="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0060.472] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.472] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.472] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.472] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.472] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.472] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.473] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.473] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.473] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.473] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.473] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.473] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.473] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.474] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.474] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.474] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.474] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.474] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.474] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.474] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.475] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.475] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.475] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.475] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.476] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.476] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.476] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.476] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.477] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.477] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.478] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.478] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.478] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.478] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.479] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.479] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.479] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.479] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.479] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.479] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.479] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.479] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.480] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.480] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.481] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.481] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.482] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.482] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.483] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.483] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.484] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.484] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.484] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.484] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.484] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.484] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.484] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.484] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.485] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.485] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.486] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.486] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.486] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.486] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.487] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.487] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.488] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.488] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.489] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.490] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.490] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.490] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.490] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.490] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.490] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.491] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.492] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.492] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.492] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.492] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.493] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.493] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.494] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.494] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.495] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.495] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.495] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.495] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.496] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.496] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.496] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.496] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.497] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.497] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.497] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.497] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x79) returned 0x59 [0060.498] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.498] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x68) returned 0x48 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.499] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.499] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.500] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x763a20 [0060.500] wsprintfW (in: param_1=0x763a20, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Microsoft Synchronization Services\\") returned 56 [0060.500] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Microsoft Synchronization Services\\" | out: DestinationString="\\??\\C:\\Program Files\\Microsoft Synchronization Services\\") [0060.500] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Microsoft Synchronization Services\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.500] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.500] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.500] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.501] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b4b8 [0060.501] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7662e0 [0060.501] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x76bee0 [0060.501] lstrcpyW (in: lpString1=0x7662e0, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0060.501] lstrcpyW (in: lpString1=0x76bee0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.501] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Microsoft Synchronization Services\\" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\") returned="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\" [0060.501] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\!!_FILES_ENCRYPTED_.txt" [0060.501] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756e88 [0060.501] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76b398 [0060.501] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756e70 [0060.501] PathFindFileNameW (pszPath="isspos.exe") returned="isspos.exe" [0060.501] _wcslwr (in: _String=0x246f54c | out: _String="isspos.exe") returned="isspos.exe" [0060.501] PathFindExtensionW (pszPath="isspos.exe") returned=".exe" [0060.501] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.501] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.501] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.502] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.502] LocalFree (hMem=0x758e50) returned 0x0 [0060.502] NtClose (Handle=0x7c) returned 0x0 [0060.502] LocalFree (hMem=0x763a20) returned 0x0 [0060.502] LocalFree (hMem=0x763c40) returned 0x0 [0060.502] LocalFree (hMem=0x763118) returned 0x0 [0060.502] LocalFree (hMem=0x763130) returned 0x0 [0060.502] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\MSBuild\\", cchMax=252 | out: psz1="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0060.502] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.502] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.502] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.502] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.502] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.503] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.503] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.503] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.503] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.503] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.503] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.503] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.503] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.504] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.504] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.505] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.505] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.505] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.505] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.505] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.505] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.505] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.505] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.505] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.505] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.505] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.505] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.505] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.505] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.506] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.506] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.506] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.507] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.507] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.507] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.508] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.508] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.508] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.508] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.509] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.509] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.509] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.509] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.510] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.510] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.510] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.510] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.510] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.510] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.511] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.511] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.511] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.511] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.512] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.512] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.512] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.512] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.512] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.513] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.514] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.514] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.514] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.514] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.514] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.514] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.515] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.515] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.515] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.515] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.516] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.516] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.516] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.516] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.516] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.517] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.517] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.517] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.518] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.518] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.518] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.518] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.518] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.519] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.519] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.519] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.519] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.520] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.520] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.520] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.520] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.520] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.520] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.521] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.522] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.522] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.522] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.523] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.523] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.523] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.523] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.523] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.524] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.524] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.524] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.524] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.524] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.524] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.524] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.524] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.524] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.524] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.524] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.524] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.524] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.524] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.524] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.524] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.524] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.524] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.524] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.524] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.524] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.524] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.524] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.524] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.524] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.524] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.524] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.524] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.524] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.525] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.525] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.525] RtlUpcaseUnicodeChar (Source=0x70) returned 0x50 [0060.525] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] RtlUpcaseUnicodeChar (Source=0x42) returned 0x42 [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] RtlUpcaseUnicodeChar (Source=0x75) returned 0x55 [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.526] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.526] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7648d0 [0060.526] wsprintfW (in: param_1=0x7648d0, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\MSBuild\\") returned 29 [0060.526] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\MSBuild\\" | out: DestinationString="\\??\\C:\\Program Files\\MSBuild\\") [0060.526] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\MSBuild\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.527] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.527] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.527] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.527] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b4f0 [0060.527] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x768018 [0060.527] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x763a20 [0060.527] lstrcpyW (in: lpString1=0x768018, lpString2="C:\\Program Files\\MSBuild\\" | out: lpString1="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0060.527] lstrcpyW (in: lpString1=0x763a20, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.527] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\MSBuild\\" | out: lpString1="\\\\?\\C:\\Program Files\\MSBuild\\") returned="\\\\?\\C:\\Program Files\\MSBuild\\" [0060.527] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\MSBuild\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\MSBuild\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\MSBuild\\!!_FILES_ENCRYPTED_.txt" [0060.527] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763130 [0060.527] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764938 [0060.528] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763118 [0060.528] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.528] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.528] LocalFree (hMem=0x758e50) returned 0x0 [0060.528] NtClose (Handle=0x7c) returned 0x0 [0060.528] LocalFree (hMem=0x7648d0) returned 0x0 [0060.528] LocalFree (hMem=0x763d50) returned 0x0 [0060.528] LocalFree (hMem=0x763148) returned 0x0 [0060.528] LocalFree (hMem=0x763160) returned 0x0 [0060.528] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Reference Assemblies\\", cchMax=252 | out: psz1="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0060.528] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.528] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.528] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.528] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.528] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.528] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.528] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.529] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.529] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.529] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.529] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.529] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.530] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.530] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.530] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.530] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.531] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.531] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.531] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.531] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.531] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.531] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.531] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.531] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.532] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.532] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.533] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.533] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.534] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.534] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.534] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.534] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.534] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.534] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.534] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.534] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.534] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.535] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.535] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.535] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.535] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.536] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.536] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.537] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.537] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.537] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.537] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.537] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.537] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.538] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.538] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.538] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.538] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.539] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.539] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.539] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.540] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.540] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.540] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.541] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.541] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.541] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.541] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.542] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.542] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.542] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.542] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.542] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.543] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.543] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.544] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.544] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.544] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.545] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.545] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.545] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.545] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.545] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.545] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.546] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.547] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.547] RtlUpcaseUnicodeChar (Source=0x52) returned 0x52 [0060.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] RtlUpcaseUnicodeChar (Source=0x66) returned 0x46 [0060.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.547] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.547] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a1b8 [0060.547] wsprintfW (in: param_1=0x76a1b8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Reference Assemblies\\") returned 42 [0060.547] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Reference Assemblies\\" | out: DestinationString="\\??\\C:\\Program Files\\Reference Assemblies\\") [0060.547] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Reference Assemblies\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.548] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.548] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.548] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.548] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b528 [0060.548] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a230 [0060.548] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76bfa8 [0060.548] lstrcpyW (in: lpString1=0x76a230, lpString2="C:\\Program Files\\Reference Assemblies\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0060.548] lstrcpyW (in: lpString1=0x76bfa8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.548] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Reference Assemblies\\" | out: lpString1="\\\\?\\C:\\Program Files\\Reference Assemblies\\") returned="\\\\?\\C:\\Program Files\\Reference Assemblies\\" [0060.549] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Reference Assemblies\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Reference Assemblies\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Reference Assemblies\\!!_FILES_ENCRYPTED_.txt" [0060.549] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763160 [0060.549] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7663f0 [0060.549] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763148 [0060.549] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.549] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.549] LocalFree (hMem=0x758e50) returned 0x0 [0060.549] NtClose (Handle=0x7c) returned 0x0 [0060.549] LocalFree (hMem=0x76a1b8) returned 0x0 [0060.549] LocalFree (hMem=0x763e30) returned 0x0 [0060.549] LocalFree (hMem=0x763178) returned 0x0 [0060.549] LocalFree (hMem=0x763190) returned 0x0 [0060.549] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Uninstall Information\\", cchMax=252 | out: psz1="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0060.549] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a1b8 [0060.549] wsprintfW (in: param_1=0x76a1b8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Uninstall Information\\") returned 43 [0060.549] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Uninstall Information\\" | out: DestinationString="\\??\\C:\\Program Files\\Uninstall Information\\") [0060.550] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Uninstall Information\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.550] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.550] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.550] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.550] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.550] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.551] LocalFree (hMem=0x758e50) returned 0x0 [0060.551] NtClose (Handle=0x7c) returned 0x0 [0060.551] LocalFree (hMem=0x76a1b8) returned 0x0 [0060.551] LocalFree (hMem=0x763f30) returned 0x0 [0060.551] LocalFree (hMem=0x7631a8) returned 0x0 [0060.551] LocalFree (hMem=0x7631c0) returned 0x0 [0060.551] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Defender\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0060.551] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a1b8 [0060.551] wsprintfW (in: param_1=0x76a1b8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Defender\\") returned 38 [0060.551] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Defender\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Defender\\") [0060.551] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Defender\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.551] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.551] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.552] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.552] PathFindFileNameW (pszPath="egypt.exe") returned="egypt.exe" [0060.552] _wcslwr (in: _String=0x246f54c | out: _String="egypt.exe") returned="egypt.exe" [0060.552] PathFindExtensionW (pszPath="egypt.exe") returned=".exe" [0060.552] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.552] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.552] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b560 [0060.552] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7648d0 [0060.552] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76c050 [0060.552] lstrcpyW (in: lpString1=0x7648d0, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0060.552] lstrcpyW (in: lpString1=0x76c050, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.552] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Defender\\") returned="\\\\?\\C:\\Program Files\\Windows Defender\\" [0060.553] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Defender\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Defender\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Defender\\!!_FILES_ENCRYPTED_.txt" [0060.553] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7631c0 [0060.553] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a2a8 [0060.553] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7631a8 [0060.553] PathFindFileNameW (pszPath="MpAsDesc.dll") returned="MpAsDesc.dll" [0060.553] _wcslwr (in: _String=0x246f54c | out: _String="mpasdesc.dll") returned="mpasdesc.dll" [0060.553] PathFindExtensionW (pszPath="MpAsDesc.dll") returned=".dll" [0060.553] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.553] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.553] PathFindFileNameW (pszPath="MpClient.dll") returned="MpClient.dll" [0060.553] _wcslwr (in: _String=0x246f54c | out: _String="mpclient.dll") returned="mpclient.dll" [0060.553] PathFindExtensionW (pszPath="MpClient.dll") returned=".dll" [0060.553] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.553] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.553] PathFindFileNameW (pszPath="MpCmdRun.exe") returned="MpCmdRun.exe" [0060.553] _wcslwr (in: _String=0x246f54c | out: _String="mpcmdrun.exe") returned="mpcmdrun.exe" [0060.553] PathFindExtensionW (pszPath="MpCmdRun.exe") returned=".exe" [0060.553] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.553] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.554] PathFindFileNameW (pszPath="MpCommu.dll") returned="MpCommu.dll" [0060.554] _wcslwr (in: _String=0x246f54c | out: _String="mpcommu.dll") returned="mpcommu.dll" [0060.554] PathFindExtensionW (pszPath="MpCommu.dll") returned=".dll" [0060.554] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.554] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.554] PathFindFileNameW (pszPath="MpEvMsg.dll") returned="MpEvMsg.dll" [0060.554] _wcslwr (in: _String=0x246f54c | out: _String="mpevmsg.dll") returned="mpevmsg.dll" [0060.554] PathFindExtensionW (pszPath="MpEvMsg.dll") returned=".dll" [0060.554] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.554] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.554] PathFindFileNameW (pszPath="MpOAV.dll") returned="MpOAV.dll" [0060.554] _wcslwr (in: _String=0x246f54c | out: _String="mpoav.dll") returned="mpoav.dll" [0060.554] PathFindExtensionW (pszPath="MpOAV.dll") returned=".dll" [0060.554] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.554] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.554] PathFindFileNameW (pszPath="MpRTP.dll") returned="MpRTP.dll" [0060.554] _wcslwr (in: _String=0x246f54c | out: _String="mprtp.dll") returned="mprtp.dll" [0060.554] PathFindExtensionW (pszPath="MpRTP.dll") returned=".dll" [0060.554] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.554] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.555] PathFindFileNameW (pszPath="MpSvc.dll") returned="MpSvc.dll" [0060.555] _wcslwr (in: _String=0x246f54c | out: _String="mpsvc.dll") returned="mpsvc.dll" [0060.555] PathFindExtensionW (pszPath="MpSvc.dll") returned=".dll" [0060.555] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.555] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.555] PathFindFileNameW (pszPath="MSASCui.exe") returned="MSASCui.exe" [0060.555] _wcslwr (in: _String=0x246f54c | out: _String="msascui.exe") returned="msascui.exe" [0060.555] PathFindExtensionW (pszPath="MSASCui.exe") returned=".exe" [0060.555] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.555] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.555] PathFindFileNameW (pszPath="MsMpCom.dll") returned="MsMpCom.dll" [0060.555] _wcslwr (in: _String=0x246f54c | out: _String="msmpcom.dll") returned="msmpcom.dll" [0060.555] PathFindExtensionW (pszPath="MsMpCom.dll") returned=".dll" [0060.555] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.555] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.555] PathFindFileNameW (pszPath="MsMpLics.dll") returned="MsMpLics.dll" [0060.555] _wcslwr (in: _String=0x246f54c | out: _String="msmplics.dll") returned="msmplics.dll" [0060.555] PathFindExtensionW (pszPath="MsMpLics.dll") returned=".dll" [0060.556] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.556] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.556] PathFindFileNameW (pszPath="MsMpRes.dll") returned="MsMpRes.dll" [0060.556] _wcslwr (in: _String=0x246f54c | out: _String="msmpres.dll") returned="msmpres.dll" [0060.556] PathFindExtensionW (pszPath="MsMpRes.dll") returned=".dll" [0060.556] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.556] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.556] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.556] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.556] LocalFree (hMem=0x758e50) returned 0x0 [0060.556] NtClose (Handle=0x7c) returned 0x0 [0060.556] LocalFree (hMem=0x76a1b8) returned 0x0 [0060.556] LocalFree (hMem=0x764048) returned 0x0 [0060.556] LocalFree (hMem=0x7631d8) returned 0x0 [0060.556] LocalFree (hMem=0x7631f0) returned 0x0 [0060.557] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Journal\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0060.557] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a1b8 [0060.557] wsprintfW (in: param_1=0x76a1b8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Journal\\") returned 37 [0060.557] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Journal\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Journal\\") [0060.557] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Journal\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.557] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.557] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.557] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.557] PathFindFileNameW (pszPath="afr38.exe") returned="afr38.exe" [0060.557] _wcslwr (in: _String=0x246f54c | out: _String="afr38.exe") returned="afr38.exe" [0060.557] PathFindExtensionW (pszPath="afr38.exe") returned=".exe" [0060.557] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.557] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.558] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b598 [0060.558] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764048 [0060.558] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76c0f8 [0060.558] lstrcpyW (in: lpString1=0x764048, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0060.558] lstrcpyW (in: lpString1=0x76c0f8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.558] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Journal\\") returned="\\\\?\\C:\\Program Files\\Windows Journal\\" [0060.558] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Journal\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Journal\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Journal\\!!_FILES_ENCRYPTED_.txt" [0060.558] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7631f0 [0060.558] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a320 [0060.558] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7631d8 [0060.558] PathFindFileNameW (pszPath="far.exe") returned="far.exe" [0060.558] _wcslwr (in: _String=0x246f54c | out: _String="far.exe") returned="far.exe" [0060.558] PathFindExtensionW (pszPath="far.exe") returned=".exe" [0060.558] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.558] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.558] PathFindFileNameW (pszPath="InkSeg.dll") returned="InkSeg.dll" [0060.558] _wcslwr (in: _String=0x246f54c | out: _String="inkseg.dll") returned="inkseg.dll" [0060.558] PathFindExtensionW (pszPath="InkSeg.dll") returned=".dll" [0060.558] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.558] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.559] PathFindFileNameW (pszPath="JNTFiltr.dll") returned="JNTFiltr.dll" [0060.559] _wcslwr (in: _String=0x246f54c | out: _String="jntfiltr.dll") returned="jntfiltr.dll" [0060.559] PathFindExtensionW (pszPath="JNTFiltr.dll") returned=".dll" [0060.559] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.559] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.559] PathFindFileNameW (pszPath="JNWDRV.dll") returned="JNWDRV.dll" [0060.559] _wcslwr (in: _String=0x246f54c | out: _String="jnwdrv.dll") returned="jnwdrv.dll" [0060.559] PathFindExtensionW (pszPath="JNWDRV.dll") returned=".dll" [0060.559] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.559] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.559] PathFindFileNameW (pszPath="jnwdui.dll") returned="jnwdui.dll" [0060.559] _wcslwr (in: _String=0x246f54c | out: _String="jnwdui.dll") returned="jnwdui.dll" [0060.559] PathFindExtensionW (pszPath="jnwdui.dll") returned=".dll" [0060.559] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.559] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.559] PathFindFileNameW (pszPath="jnwmon.dll") returned="jnwmon.dll" [0060.559] _wcslwr (in: _String=0x246f54c | out: _String="jnwmon.dll") returned="jnwmon.dll" [0060.559] PathFindExtensionW (pszPath="jnwmon.dll") returned=".dll" [0060.559] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.559] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.560] PathFindFileNameW (pszPath="jnwppr.dll") returned="jnwppr.dll" [0060.560] _wcslwr (in: _String=0x246f54c | out: _String="jnwppr.dll") returned="jnwppr.dll" [0060.560] PathFindExtensionW (pszPath="jnwppr.dll") returned=".dll" [0060.560] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.560] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.560] PathFindFileNameW (pszPath="Journal.exe") returned="Journal.exe" [0060.560] _wcslwr (in: _String=0x246f54c | out: _String="journal.exe") returned="journal.exe" [0060.560] PathFindExtensionW (pszPath="Journal.exe") returned=".exe" [0060.560] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.560] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.560] PathFindFileNameW (pszPath="MSPVWCTL.DLL") returned="MSPVWCTL.DLL" [0060.560] _wcslwr (in: _String=0x246f54c | out: _String="mspvwctl.dll") returned="mspvwctl.dll" [0060.560] PathFindExtensionW (pszPath="MSPVWCTL.DLL") returned=".DLL" [0060.560] lstrcatW (in: lpString1="", lpString2="DLL" | out: lpString1="DLL") returned="DLL" [0060.560] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.560] PathFindFileNameW (pszPath="NBDoc.DLL") returned="NBDoc.DLL" [0060.560] _wcslwr (in: _String=0x246f54c | out: _String="nbdoc.dll") returned="nbdoc.dll" [0060.560] PathFindExtensionW (pszPath="NBDoc.DLL") returned=".DLL" [0060.560] lstrcatW (in: lpString1="", lpString2="DLL" | out: lpString1="DLL") returned="DLL" [0060.560] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.561] PathFindFileNameW (pszPath="NBMapTIP.dll") returned="NBMapTIP.dll" [0060.561] _wcslwr (in: _String=0x246f54c | out: _String="nbmaptip.dll") returned="nbmaptip.dll" [0060.561] PathFindExtensionW (pszPath="NBMapTIP.dll") returned=".dll" [0060.561] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.561] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.561] PathFindFileNameW (pszPath="PDIALOG.exe") returned="PDIALOG.exe" [0060.561] _wcslwr (in: _String=0x246f54c | out: _String="pdialog.exe") returned="pdialog.exe" [0060.561] PathFindExtensionW (pszPath="PDIALOG.exe") returned=".exe" [0060.561] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.561] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.561] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b5d0 [0060.561] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7649a0 [0060.561] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76c1a0 [0060.561] lstrcpyW (in: lpString1=0x7649a0, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0060.561] lstrcpyW (in: lpString1=0x76c1a0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.561] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Journal\\") returned="\\\\?\\C:\\Program Files\\Windows Journal\\" [0060.561] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Journal\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Journal\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Journal\\!!_FILES_ENCRYPTED_.txt" [0060.561] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763190 [0060.561] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a398 [0060.561] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763178 [0060.561] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.562] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.562] LocalFree (hMem=0x758e50) returned 0x0 [0060.562] NtClose (Handle=0x7c) returned 0x0 [0060.562] LocalFree (hMem=0x76a1b8) returned 0x0 [0060.562] LocalFree (hMem=0x7640b0) returned 0x0 [0060.562] LocalFree (hMem=0x763208) returned 0x0 [0060.562] LocalFree (hMem=0x763220) returned 0x0 [0060.562] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Mail\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0060.562] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7640b0 [0060.562] wsprintfW (in: param_1=0x7640b0, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Mail\\") returned 34 [0060.562] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Mail\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Mail\\") [0060.562] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Mail\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.562] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.562] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.563] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.563] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b608 [0060.563] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764a08 [0060.563] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76c248 [0060.563] lstrcpyW (in: lpString1=0x764a08, lpString2="C:\\Program Files\\Windows Mail\\" | out: lpString1="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0060.563] lstrcpyW (in: lpString1=0x76c248, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.563] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Mail\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Mail\\") returned="\\\\?\\C:\\Program Files\\Windows Mail\\" [0060.563] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Mail\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Mail\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Mail\\!!_FILES_ENCRYPTED_.txt" [0060.563] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763220 [0060.563] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764a70 [0060.563] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763208 [0060.563] PathFindFileNameW (pszPath="msoe.dll") returned="msoe.dll" [0060.563] _wcslwr (in: _String=0x246f54c | out: _String="msoe.dll") returned="msoe.dll" [0060.563] PathFindExtensionW (pszPath="msoe.dll") returned=".dll" [0060.563] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.563] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.564] PathFindFileNameW (pszPath="MSOERES.dll") returned="MSOERES.dll" [0060.564] _wcslwr (in: _String=0x246f54c | out: _String="msoeres.dll") returned="msoeres.dll" [0060.564] PathFindExtensionW (pszPath="MSOERES.dll") returned=".dll" [0060.564] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.564] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.564] PathFindFileNameW (pszPath="oeimport.dll") returned="oeimport.dll" [0060.564] _wcslwr (in: _String=0x246f54c | out: _String="oeimport.dll") returned="oeimport.dll" [0060.564] PathFindExtensionW (pszPath="oeimport.dll") returned=".dll" [0060.564] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.564] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.564] PathFindFileNameW (pszPath="programming-developed.exe") returned="programming-developed.exe" [0060.564] _wcslwr (in: _String=0x246f54c | out: _String="programming-developed.exe") returned="programming-developed.exe" [0060.564] PathFindExtensionW (pszPath="programming-developed.exe") returned=".exe" [0060.564] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.564] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.564] PathFindFileNameW (pszPath="wab.exe") returned="wab.exe" [0060.564] _wcslwr (in: _String=0x246f54c | out: _String="wab.exe") returned="wab.exe" [0060.564] PathFindExtensionW (pszPath="wab.exe") returned=".exe" [0060.564] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.564] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.565] PathFindFileNameW (pszPath="wabfind.dll") returned="wabfind.dll" [0060.565] _wcslwr (in: _String=0x246f54c | out: _String="wabfind.dll") returned="wabfind.dll" [0060.565] PathFindExtensionW (pszPath="wabfind.dll") returned=".dll" [0060.565] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.565] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.565] PathFindFileNameW (pszPath="wabimp.dll") returned="wabimp.dll" [0060.565] _wcslwr (in: _String=0x246f54c | out: _String="wabimp.dll") returned="wabimp.dll" [0060.565] PathFindExtensionW (pszPath="wabimp.dll") returned=".dll" [0060.565] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.565] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.565] PathFindFileNameW (pszPath="wabmig.exe") returned="wabmig.exe" [0060.565] _wcslwr (in: _String=0x246f54c | out: _String="wabmig.exe") returned="wabmig.exe" [0060.565] PathFindExtensionW (pszPath="wabmig.exe") returned=".exe" [0060.565] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.565] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.565] PathFindFileNameW (pszPath="WinMail.exe") returned="WinMail.exe" [0060.565] _wcslwr (in: _String=0x246f54c | out: _String="winmail.exe") returned="winmail.exe" [0060.565] PathFindExtensionW (pszPath="WinMail.exe") returned=".exe" [0060.565] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.566] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.566] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.566] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.566] LocalFree (hMem=0x758e50) returned 0x0 [0060.566] NtClose (Handle=0x7c) returned 0x0 [0060.566] LocalFree (hMem=0x7640b0) returned 0x0 [0060.566] LocalFree (hMem=0x764118) returned 0x0 [0060.566] LocalFree (hMem=0x763238) returned 0x0 [0060.566] LocalFree (hMem=0x763250) returned 0x0 [0060.566] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Media Player\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.566] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a1b8 [0060.566] wsprintfW (in: param_1=0x76a1b8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Media Player\\") returned 42 [0060.566] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Media Player\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Media Player\\") [0060.566] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Media Player\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.567] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.567] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.567] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.567] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b640 [0060.567] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a410 [0060.567] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76c2e0 [0060.567] lstrcpyW (in: lpString1=0x76a410, lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.567] lstrcpyW (in: lpString1=0x76c2e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.567] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\" [0060.568] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt" [0060.568] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763250 [0060.568] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a488 [0060.568] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763238 [0060.568] PathFindFileNameW (pszPath="gmailnotifierpro.exe") returned="gmailnotifierpro.exe" [0060.568] _wcslwr (in: _String=0x246f54c | out: _String="gmailnotifierpro.exe") returned="gmailnotifierpro.exe" [0060.568] PathFindExtensionW (pszPath="gmailnotifierpro.exe") returned=".exe" [0060.568] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.568] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.568] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b678 [0060.568] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a500 [0060.568] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76c388 [0060.568] lstrcpyW (in: lpString1=0x76a500, lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.568] lstrcpyW (in: lpString1=0x76c388, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.568] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\" [0060.568] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt" [0060.568] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763100 [0060.568] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c448 [0060.569] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a7e0 [0060.569] PathFindFileNameW (pszPath="icq.exe") returned="icq.exe" [0060.569] _wcslwr (in: _String=0x246f54c | out: _String="icq.exe") returned="icq.exe" [0060.569] PathFindExtensionW (pszPath="icq.exe") returned=".exe" [0060.569] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.569] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.569] PathFindFileNameW (pszPath="isaac-costs.exe") returned="isaac-costs.exe" [0060.569] _wcslwr (in: _String=0x246f54c | out: _String="isaac-costs.exe") returned="isaac-costs.exe" [0060.569] PathFindExtensionW (pszPath="isaac-costs.exe") returned=".exe" [0060.569] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.569] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.569] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b6b0 [0060.569] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c4c0 [0060.569] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76d430 [0060.569] lstrcpyW (in: lpString1=0x76c4c0, lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.569] lstrcpyW (in: lpString1=0x76d430, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.569] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\" [0060.569] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt" [0060.570] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a7f8 [0060.570] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766478 [0060.570] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a810 [0060.570] PathFindFileNameW (pszPath="mpvis.DLL") returned="mpvis.DLL" [0060.570] _wcslwr (in: _String=0x246f54c | out: _String="mpvis.dll") returned="mpvis.dll" [0060.570] PathFindExtensionW (pszPath="mpvis.DLL") returned=".DLL" [0060.570] lstrcatW (in: lpString1="", lpString2="DLL" | out: lpString1="DLL") returned="DLL" [0060.570] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.570] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b6e8 [0060.570] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c538 [0060.570] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76d4d8 [0060.570] lstrcpyW (in: lpString1=0x76c538, lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.570] lstrcpyW (in: lpString1=0x76d4d8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.570] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\" [0060.570] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt" [0060.570] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a828 [0060.570] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76d580 [0060.570] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a840 [0060.570] PathFindFileNameW (pszPath="setup_wm.exe") returned="setup_wm.exe" [0060.570] _wcslwr (in: _String=0x246f54c | out: _String="setup_wm.exe") returned="setup_wm.exe" [0060.570] PathFindExtensionW (pszPath="setup_wm.exe") returned=".exe" [0060.571] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.571] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b720 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c5b0 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76d618 [0060.571] lstrcpyW (in: lpString1=0x76c5b0, lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.571] lstrcpyW (in: lpString1=0x76d618, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.571] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\" [0060.571] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt" [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a858 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c628 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a870 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b758 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c6a0 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76d6c0 [0060.571] lstrcpyW (in: lpString1=0x76c6a0, lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="C:\\Program Files\\Windows Media Player\\") returned="C:\\Program Files\\Windows Media Player\\" [0060.571] lstrcpyW (in: lpString1=0x76d6c0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.571] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Media Player\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\" [0060.571] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Media Player\\!!_FILES_ENCRYPTED_.txt" [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a888 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766500 [0060.571] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a8a0 [0060.572] PathFindFileNameW (pszPath="wmlaunch.exe") returned="wmlaunch.exe" [0060.572] _wcslwr (in: _String=0x246f54c | out: _String="wmlaunch.exe") returned="wmlaunch.exe" [0060.572] PathFindExtensionW (pszPath="wmlaunch.exe") returned=".exe" [0060.572] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.572] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.572] PathFindFileNameW (pszPath="wmpconfig.exe") returned="wmpconfig.exe" [0060.572] _wcslwr (in: _String=0x246f54c | out: _String="wmpconfig.exe") returned="wmpconfig.exe" [0060.572] PathFindExtensionW (pszPath="wmpconfig.exe") returned=".exe" [0060.572] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.572] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.572] PathFindFileNameW (pszPath="WMPDMC.exe") returned="WMPDMC.exe" [0060.572] _wcslwr (in: _String=0x246f54c | out: _String="wmpdmc.exe") returned="wmpdmc.exe" [0060.572] PathFindExtensionW (pszPath="WMPDMC.exe") returned=".exe" [0060.572] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.572] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.572] PathFindFileNameW (pszPath="WMPDMCCore.dll") returned="WMPDMCCore.dll" [0060.572] _wcslwr (in: _String=0x246f54c | out: _String="wmpdmccore.dll") returned="wmpdmccore.dll" [0060.572] PathFindExtensionW (pszPath="WMPDMCCore.dll") returned=".dll" [0060.572] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.572] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.573] PathFindFileNameW (pszPath="wmpenc.exe") returned="wmpenc.exe" [0060.573] _wcslwr (in: _String=0x246f54c | out: _String="wmpenc.exe") returned="wmpenc.exe" [0060.573] PathFindExtensionW (pszPath="wmpenc.exe") returned=".exe" [0060.573] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.573] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.573] PathFindFileNameW (pszPath="wmplayer.exe") returned="wmplayer.exe" [0060.573] _wcslwr (in: _String=0x246f54c | out: _String="wmplayer.exe") returned="wmplayer.exe" [0060.573] PathFindExtensionW (pszPath="wmplayer.exe") returned=".exe" [0060.573] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.573] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.573] PathFindFileNameW (pszPath="WMPMediaSharing.dll") returned="WMPMediaSharing.dll" [0060.573] _wcslwr (in: _String=0x246f54c | out: _String="wmpmediasharing.dll") returned="wmpmediasharing.dll" [0060.573] PathFindExtensionW (pszPath="WMPMediaSharing.dll") returned=".dll" [0060.573] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.573] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.573] PathFindFileNameW (pszPath="wmpnetwk.exe") returned="wmpnetwk.exe" [0060.573] _wcslwr (in: _String=0x246f54c | out: _String="wmpnetwk.exe") returned="wmpnetwk.exe" [0060.573] PathFindExtensionW (pszPath="wmpnetwk.exe") returned=".exe" [0060.573] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.573] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.573] PathFindFileNameW (pszPath="wmpnscfg.exe") returned="wmpnscfg.exe" [0060.574] _wcslwr (in: _String=0x246f54c | out: _String="wmpnscfg.exe") returned="wmpnscfg.exe" [0060.574] PathFindExtensionW (pszPath="wmpnscfg.exe") returned=".exe" [0060.574] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.574] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.574] PathFindFileNameW (pszPath="wmpnssci.dll") returned="wmpnssci.dll" [0060.574] _wcslwr (in: _String=0x246f54c | out: _String="wmpnssci.dll") returned="wmpnssci.dll" [0060.574] PathFindExtensionW (pszPath="wmpnssci.dll") returned=".dll" [0060.574] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.574] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.574] PathFindFileNameW (pszPath="WMPNSSUI.dll") returned="WMPNSSUI.dll" [0060.574] _wcslwr (in: _String=0x246f54c | out: _String="wmpnssui.dll") returned="wmpnssui.dll" [0060.574] PathFindExtensionW (pszPath="WMPNSSUI.dll") returned=".dll" [0060.574] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.574] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.574] PathFindFileNameW (pszPath="wmprph.exe") returned="wmprph.exe" [0060.574] _wcslwr (in: _String=0x246f54c | out: _String="wmprph.exe") returned="wmprph.exe" [0060.574] PathFindExtensionW (pszPath="wmprph.exe") returned=".exe" [0060.574] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.574] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.574] PathFindFileNameW (pszPath="wmpshare.exe") returned="wmpshare.exe" [0060.575] _wcslwr (in: _String=0x246f54c | out: _String="wmpshare.exe") returned="wmpshare.exe" [0060.575] PathFindExtensionW (pszPath="wmpshare.exe") returned=".exe" [0060.575] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.575] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.575] PathFindFileNameW (pszPath="WMPSideShowGadget.exe") returned="WMPSideShowGadget.exe" [0060.575] _wcslwr (in: _String=0x246f54c | out: _String="wmpsideshowgadget.exe") returned="wmpsideshowgadget.exe" [0060.575] PathFindExtensionW (pszPath="WMPSideShowGadget.exe") returned=".exe" [0060.575] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.575] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.575] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.575] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.575] LocalFree (hMem=0x758e50) returned 0x0 [0060.575] NtClose (Handle=0x7c) returned 0x0 [0060.575] LocalFree (hMem=0x76a1b8) returned 0x0 [0060.576] LocalFree (hMem=0x7670b8) returned 0x0 [0060.576] LocalFree (hMem=0x763268) returned 0x0 [0060.576] LocalFree (hMem=0x763280) returned 0x0 [0060.576] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows NT\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows NT\\") returned="C:\\Program Files\\Windows NT\\" [0060.576] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764118 [0060.576] wsprintfW (in: param_1=0x764118, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows NT\\") returned 32 [0060.576] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows NT\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows NT\\") [0060.576] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows NT\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.576] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.576] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.576] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.576] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b790 [0060.576] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x768070 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76d768 [0060.577] lstrcpyW (in: lpString1=0x768070, lpString2="C:\\Program Files\\Windows NT\\" | out: lpString1="C:\\Program Files\\Windows NT\\") returned="C:\\Program Files\\Windows NT\\" [0060.577] lstrcpyW (in: lpString1=0x76d768, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.577] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows NT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows NT\\") returned="\\\\?\\C:\\Program Files\\Windows NT\\" [0060.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows NT\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows NT\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows NT\\!!_FILES_ENCRYPTED_.txt" [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763280 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76a1b8 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763268 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b7c8 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x7680c8 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76d800 [0060.577] lstrcpyW (in: lpString1=0x7680c8, lpString2="C:\\Program Files\\Windows NT\\" | out: lpString1="C:\\Program Files\\Windows NT\\") returned="C:\\Program Files\\Windows NT\\" [0060.577] lstrcpyW (in: lpString1=0x76d800, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.577] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows NT\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows NT\\") returned="\\\\?\\C:\\Program Files\\Windows NT\\" [0060.577] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows NT\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows NT\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows NT\\!!_FILES_ENCRYPTED_.txt" [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a8b8 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c718 [0060.577] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a8d0 [0060.577] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.577] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.578] LocalFree (hMem=0x758e50) returned 0x0 [0060.578] NtClose (Handle=0x7c) returned 0x0 [0060.578] LocalFree (hMem=0x764118) returned 0x0 [0060.578] LocalFree (hMem=0x767130) returned 0x0 [0060.578] LocalFree (hMem=0x763298) returned 0x0 [0060.578] LocalFree (hMem=0x7632b0) returned 0x0 [0060.578] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Photo Viewer\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Photo Viewer\\") returned="C:\\Program Files\\Windows Photo Viewer\\" [0060.578] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c790 [0060.578] wsprintfW (in: param_1=0x76c790, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Photo Viewer\\") returned 42 [0060.578] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Photo Viewer\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Photo Viewer\\") [0060.578] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Photo Viewer\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.578] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.578] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.589] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.589] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b800 [0060.589] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c808 [0060.589] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x7670b8 [0060.589] lstrcpyW (in: lpString1=0x76c808, lpString2="C:\\Program Files\\Windows Photo Viewer\\" | out: lpString1="C:\\Program Files\\Windows Photo Viewer\\") returned="C:\\Program Files\\Windows Photo Viewer\\" [0060.590] lstrcpyW (in: lpString1=0x7670b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.590] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Photo Viewer\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\") returned="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\" [0060.590] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\!!_FILES_ENCRYPTED_.txt" [0060.590] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7632b0 [0060.590] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c880 [0060.590] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763298 [0060.590] PathFindFileNameW (pszPath="ImagingDevices.exe") returned="ImagingDevices.exe" [0060.590] _wcslwr (in: _String=0x246f54c | out: _String="imagingdevices.exe") returned="imagingdevices.exe" [0060.590] PathFindExtensionW (pszPath="ImagingDevices.exe") returned=".exe" [0060.590] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.590] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.590] PathFindFileNameW (pszPath="ImagingEngine.dll") returned="ImagingEngine.dll" [0060.590] _wcslwr (in: _String=0x246f54c | out: _String="imagingengine.dll") returned="imagingengine.dll" [0060.590] PathFindExtensionW (pszPath="ImagingEngine.dll") returned=".dll" [0060.590] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.590] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.591] PathFindFileNameW (pszPath="PhotoAcq.dll") returned="PhotoAcq.dll" [0060.591] _wcslwr (in: _String=0x246f54c | out: _String="photoacq.dll") returned="photoacq.dll" [0060.591] PathFindExtensionW (pszPath="PhotoAcq.dll") returned=".dll" [0060.591] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.591] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.591] PathFindFileNameW (pszPath="PhotoBase.dll") returned="PhotoBase.dll" [0060.591] _wcslwr (in: _String=0x246f54c | out: _String="photobase.dll") returned="photobase.dll" [0060.591] PathFindExtensionW (pszPath="PhotoBase.dll") returned=".dll" [0060.591] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.591] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.591] PathFindFileNameW (pszPath="PhotoViewer.dll") returned="PhotoViewer.dll" [0060.591] _wcslwr (in: _String=0x246f54c | out: _String="photoviewer.dll") returned="photoviewer.dll" [0060.591] PathFindExtensionW (pszPath="PhotoViewer.dll") returned=".dll" [0060.591] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.591] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.591] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.592] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.592] LocalFree (hMem=0x758e50) returned 0x0 [0060.592] NtClose (Handle=0x7c) returned 0x0 [0060.593] LocalFree (hMem=0x76c790) returned 0x0 [0060.593] LocalFree (hMem=0x767188) returned 0x0 [0060.593] LocalFree (hMem=0x7632c8) returned 0x0 [0060.594] LocalFree (hMem=0x7632e0) returned 0x0 [0060.594] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Portable Devices\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Portable Devices\\") returned="C:\\Program Files\\Windows Portable Devices\\" [0060.594] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766588 [0060.594] wsprintfW (in: param_1=0x766588, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Portable Devices\\") returned 46 [0060.594] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Portable Devices\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Portable Devices\\") [0060.594] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Portable Devices\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.594] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.594] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.595] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.595] PathFindFileNameW (pszPath="barca.exe") returned="barca.exe" [0060.595] _wcslwr (in: _String=0x246f54c | out: _String="barca.exe") returned="barca.exe" [0060.595] PathFindExtensionW (pszPath="barca.exe") returned=".exe" [0060.595] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.595] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.595] PathFindFileNameW (pszPath="edcsvr.exe") returned="edcsvr.exe" [0060.595] _wcslwr (in: _String=0x246f54c | out: _String="edcsvr.exe") returned="edcsvr.exe" [0060.595] PathFindExtensionW (pszPath="edcsvr.exe") returned=".exe" [0060.595] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.595] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.595] PathFindFileNameW (pszPath="sqmapi.dll") returned="sqmapi.dll" [0060.595] _wcslwr (in: _String=0x246f54c | out: _String="sqmapi.dll") returned="sqmapi.dll" [0060.595] PathFindExtensionW (pszPath="sqmapi.dll") returned=".dll" [0060.595] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.595] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.595] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.596] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.596] LocalFree (hMem=0x758e50) returned 0x0 [0060.596] NtClose (Handle=0x7c) returned 0x0 [0060.596] LocalFree (hMem=0x766588) returned 0x0 [0060.596] LocalFree (hMem=0x767200) returned 0x0 [0060.596] LocalFree (hMem=0x7632f8) returned 0x0 [0060.596] LocalFree (hMem=0x763310) returned 0x0 [0060.596] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files\\Windows Sidebar\\", cchMax=252 | out: psz1="C:\\Program Files\\Windows Sidebar\\") returned="C:\\Program Files\\Windows Sidebar\\" [0060.596] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c790 [0060.596] wsprintfW (in: param_1=0x76c790, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files\\Windows Sidebar\\") returned 37 [0060.596] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files\\Windows Sidebar\\" | out: DestinationString="\\??\\C:\\Program Files\\Windows Sidebar\\") [0060.596] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files\\Windows Sidebar\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.597] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.597] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.597] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.597] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b838 [0060.597] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764118 [0060.597] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76d8b0 [0060.597] lstrcpyW (in: lpString1=0x764118, lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="C:\\Program Files\\Windows Sidebar\\") returned="C:\\Program Files\\Windows Sidebar\\" [0060.597] lstrcpyW (in: lpString1=0x76d8b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.597] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\" [0060.598] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\!!_FILES_ENCRYPTED_.txt" [0060.598] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763310 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c8f8 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7632f8 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b870 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7640b0 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76d958 [0060.598] lstrcpyW (in: lpString1=0x7640b0, lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="C:\\Program Files\\Windows Sidebar\\") returned="C:\\Program Files\\Windows Sidebar\\" [0060.598] lstrcpyW (in: lpString1=0x76d958, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.598] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\" [0060.598] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\!!_FILES_ENCRYPTED_.txt" [0060.598] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7632e0 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c970 [0060.598] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7632c8 [0060.598] PathFindFileNameW (pszPath="sbdrop.dll") returned="sbdrop.dll" [0060.598] _wcslwr (in: _String=0x246f54c | out: _String="sbdrop.dll") returned="sbdrop.dll" [0060.598] PathFindExtensionW (pszPath="sbdrop.dll") returned=".dll" [0060.598] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.599] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.599] PathFindFileNameW (pszPath="settings.ini") returned="settings.ini" [0060.599] _wcslwr (in: _String=0x246f54c | out: _String="settings.ini") returned="settings.ini" [0060.599] PathFindExtensionW (pszPath="settings.ini") returned=".ini" [0060.599] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.599] _wcslwr (in: _String=0x762078 | out: _String="ini") returned="ini" [0060.599] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b8a8 [0060.599] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764ad8 [0060.599] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76da00 [0060.599] lstrcpyW (in: lpString1=0x764ad8, lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="C:\\Program Files\\Windows Sidebar\\") returned="C:\\Program Files\\Windows Sidebar\\" [0060.599] lstrcpyW (in: lpString1=0x76da00, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.599] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\" [0060.599] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\", lpString2="settings.ini" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\settings.ini") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\settings.ini" [0060.599] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b8e0 [0060.599] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764b40 [0060.599] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76daa8 [0060.599] lstrcpyW (in: lpString1=0x764b40, lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="C:\\Program Files\\Windows Sidebar\\") returned="C:\\Program Files\\Windows Sidebar\\" [0060.599] lstrcpyW (in: lpString1=0x76daa8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.599] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files\\Windows Sidebar\\" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\" [0060.599] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files\\Windows Sidebar\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files\\Windows Sidebar\\!!_FILES_ENCRYPTED_.txt" [0060.599] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a8e8 [0060.600] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766588 [0060.600] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a900 [0060.600] PathFindFileNameW (pszPath="sidebar.exe") returned="sidebar.exe" [0060.600] _wcslwr (in: _String=0x246f54c | out: _String="sidebar.exe") returned="sidebar.exe" [0060.600] PathFindExtensionW (pszPath="sidebar.exe") returned=".exe" [0060.600] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.600] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.600] PathFindFileNameW (pszPath="spcwin.exe") returned="spcwin.exe" [0060.600] _wcslwr (in: _String=0x246f54c | out: _String="spcwin.exe") returned="spcwin.exe" [0060.600] PathFindExtensionW (pszPath="spcwin.exe") returned=".exe" [0060.600] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.600] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.600] PathFindFileNameW (pszPath="wlsrvc.dll") returned="wlsrvc.dll" [0060.600] _wcslwr (in: _String=0x246f54c | out: _String="wlsrvc.dll") returned="wlsrvc.dll" [0060.600] PathFindExtensionW (pszPath="wlsrvc.dll") returned=".dll" [0060.600] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.600] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.600] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.601] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.601] LocalFree (hMem=0x758e50) returned 0x0 [0060.601] NtClose (Handle=0x7c) returned 0x0 [0060.601] LocalFree (hMem=0x76c790) returned 0x0 [0060.601] LocalFree (hMem=0x764180) returned 0x0 [0060.601] LocalFree (hMem=0x763328) returned 0x0 [0060.601] LocalFree (hMem=0x763340) returned 0x0 [0060.601] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Adobe\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0060.601] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.601] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.601] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.601] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.601] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.601] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.601] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.601] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.601] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.602] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.602] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.602] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.603] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.603] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.603] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.603] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.603] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.603] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.603] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.604] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.604] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.604] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.604] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.604] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.605] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.605] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.605] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.606] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.606] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.606] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.606] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.607] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.607] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.607] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.607] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.608] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.608] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.608] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.608] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.608] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.608] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.609] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.609] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.610] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.610] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.610] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.610] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.610] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.610] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.611] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.611] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.611] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.611] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.612] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.612] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.612] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.612] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.613] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.613] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.613] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.613] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.613] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.613] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.614] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.614] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.614] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.614] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.614] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.614] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.614] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.614] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.614] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.614] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.614] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.614] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.615] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.615] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.615] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.615] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.615] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.615] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.615] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.616] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.616] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.616] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.616] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.617] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.617] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.617] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.617] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.617] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.617] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.618] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.618] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.618] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.618] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.619] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.619] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.619] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.619] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.619] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.619] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.620] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.621] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.621] RtlUpcaseUnicodeChar (Source=0x41) returned 0x41 [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x64) returned 0x44 [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x62) returned 0x42 [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.621] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.621] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.621] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.621] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.621] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.621] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.622] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.622] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.623] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764180 [0060.623] wsprintfW (in: param_1=0x764180, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Adobe\\") returned 33 [0060.623] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Adobe\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Adobe\\") [0060.623] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Adobe\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.623] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.623] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.624] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.624] PathFindFileNameW (pszPath="growsrecordingaggressive.exe") returned="growsrecordingaggressive.exe" [0060.624] _wcslwr (in: _String=0x246f54c | out: _String="growsrecordingaggressive.exe") returned="growsrecordingaggressive.exe" [0060.624] PathFindExtensionW (pszPath="growsrecordingaggressive.exe") returned=".exe" [0060.624] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.624] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.624] PathFindFileNameW (pszPath="omnipos.exe") returned="omnipos.exe" [0060.624] _wcslwr (in: _String=0x246f54c | out: _String="omnipos.exe") returned="omnipos.exe" [0060.624] PathFindExtensionW (pszPath="omnipos.exe") returned=".exe" [0060.624] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.625] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.625] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b918 [0060.625] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x768120 [0060.625] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x767160 [0060.625] lstrcpyW (in: lpString1=0x768120, lpString2="C:\\Program Files (x86)\\Adobe\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0060.625] lstrcpyW (in: lpString1=0x767160, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.625] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Adobe\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Adobe\\") returned="\\\\?\\C:\\Program Files (x86)\\Adobe\\" [0060.625] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Adobe\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Adobe\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Adobe\\!!_FILES_ENCRYPTED_.txt" [0060.625] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763340 [0060.625] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c790 [0060.625] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763328 [0060.625] PathFindFileNameW (pszPath="webdrive.exe") returned="webdrive.exe" [0060.625] _wcslwr (in: _String=0x246f54c | out: _String="webdrive.exe") returned="webdrive.exe" [0060.625] PathFindExtensionW (pszPath="webdrive.exe") returned=".exe" [0060.625] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.625] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.625] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.625] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.626] LocalFree (hMem=0x758e50) returned 0x0 [0060.626] NtClose (Handle=0x7c) returned 0x0 [0060.626] LocalFree (hMem=0x764180) returned 0x0 [0060.626] LocalFree (hMem=0x7672d0) returned 0x0 [0060.626] LocalFree (hMem=0x756fa8) returned 0x0 [0060.626] LocalFree (hMem=0x756f90) returned 0x0 [0060.626] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Common Files\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0060.626] LocalFree (hMem=0x7641e8) returned 0x0 [0060.626] LocalFree (hMem=0x763358) returned 0x0 [0060.626] LocalFree (hMem=0x763370) returned 0x0 [0060.626] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Google\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0060.626] LocalFree (hMem=0x764250) returned 0x0 [0060.626] LocalFree (hMem=0x763388) returned 0x0 [0060.626] LocalFree (hMem=0x7633a0) returned 0x0 [0060.626] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Internet Explorer\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Internet Explorer\\") returned="C:\\Program Files (x86)\\Internet Explorer\\" [0060.626] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766610 [0060.626] wsprintfW (in: param_1=0x766610, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Internet Explorer\\") returned 45 [0060.626] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Internet Explorer\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Internet Explorer\\") [0060.627] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Internet Explorer\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.627] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.627] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.627] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.627] PathFindFileNameW (pszPath="creditservice.exe") returned="creditservice.exe" [0060.627] _wcslwr (in: _String=0x246f54c | out: _String="creditservice.exe") returned="creditservice.exe" [0060.627] PathFindExtensionW (pszPath="creditservice.exe") returned=".exe" [0060.627] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.628] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.628] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b950 [0060.628] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76c9e8 [0060.628] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x76f898 [0060.628] lstrcpyW (in: lpString1=0x76c9e8, lpString2="C:\\Program Files (x86)\\Internet Explorer\\" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\") returned="C:\\Program Files (x86)\\Internet Explorer\\" [0060.628] lstrcpyW (in: lpString1=0x76f898, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.628] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Internet Explorer\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\") returned="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\" [0060.628] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\!!_FILES_ENCRYPTED_.txt" [0060.628] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7633a0 [0060.628] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766698 [0060.628] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763388 [0060.628] PathFindFileNameW (pszPath="ExtExport.exe") returned="ExtExport.exe" [0060.628] _wcslwr (in: _String=0x246f54c | out: _String="extexport.exe") returned="extexport.exe" [0060.628] PathFindExtensionW (pszPath="ExtExport.exe") returned=".exe" [0060.628] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.628] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.628] PathFindFileNameW (pszPath="fpos.exe") returned="fpos.exe" [0060.628] _wcslwr (in: _String=0x246f54c | out: _String="fpos.exe") returned="fpos.exe" [0060.628] PathFindExtensionW (pszPath="fpos.exe") returned=".exe" [0060.628] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.628] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.628] PathFindFileNameW (pszPath="hmmapi.dll") returned="hmmapi.dll" [0060.628] _wcslwr (in: _String=0x246f54c | out: _String="hmmapi.dll") returned="hmmapi.dll" [0060.629] PathFindExtensionW (pszPath="hmmapi.dll") returned=".dll" [0060.629] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.629] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.629] PathFindFileNameW (pszPath="ie8props.propdesc") returned="ie8props.propdesc" [0060.629] _wcslwr (in: _String=0x246f54c | out: _String="ie8props.propdesc") returned="ie8props.propdesc" [0060.629] PathFindExtensionW (pszPath="ie8props.propdesc") returned=".propdesc" [0060.629] lstrcatW (in: lpString1="", lpString2="propdesc" | out: lpString1="propdesc") returned="propdesc" [0060.629] _wcslwr (in: _String=0x762078 | out: _String="propdesc") returned="propdesc" [0060.629] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b988 [0060.629] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76ca60 [0060.629] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x76f950 [0060.629] lstrcpyW (in: lpString1=0x76ca60, lpString2="C:\\Program Files (x86)\\Internet Explorer\\" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\") returned="C:\\Program Files (x86)\\Internet Explorer\\" [0060.629] lstrcpyW (in: lpString1=0x76f950, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.629] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Internet Explorer\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\") returned="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\" [0060.629] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\", lpString2="ie8props.propdesc" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\ie8props.propdesc") returned="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\ie8props.propdesc" [0060.629] PathFindFileNameW (pszPath="iecompat.dll") returned="iecompat.dll" [0060.629] _wcslwr (in: _String=0x246f54c | out: _String="iecompat.dll") returned="iecompat.dll" [0060.630] PathFindExtensionW (pszPath="iecompat.dll") returned=".dll" [0060.630] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.630] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.630] PathFindFileNameW (pszPath="iedvtool.dll") returned="iedvtool.dll" [0060.630] _wcslwr (in: _String=0x246f54c | out: _String="iedvtool.dll") returned="iedvtool.dll" [0060.630] PathFindExtensionW (pszPath="iedvtool.dll") returned=".dll" [0060.630] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.630] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.630] PathFindFileNameW (pszPath="ieinstal.exe") returned="ieinstal.exe" [0060.630] _wcslwr (in: _String=0x246f54c | out: _String="ieinstal.exe") returned="ieinstal.exe" [0060.630] PathFindExtensionW (pszPath="ieinstal.exe") returned=".exe" [0060.631] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.631] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.631] PathFindFileNameW (pszPath="ielowutil.exe") returned="ielowutil.exe" [0060.631] _wcslwr (in: _String=0x246f54c | out: _String="ielowutil.exe") returned="ielowutil.exe" [0060.631] PathFindExtensionW (pszPath="ielowutil.exe") returned=".exe" [0060.631] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.631] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.631] PathFindFileNameW (pszPath="ieproxy.dll") returned="ieproxy.dll" [0060.631] _wcslwr (in: _String=0x246f54c | out: _String="ieproxy.dll") returned="ieproxy.dll" [0060.631] PathFindExtensionW (pszPath="ieproxy.dll") returned=".dll" [0060.631] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.631] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.631] PathFindFileNameW (pszPath="IEShims.dll") returned="IEShims.dll" [0060.631] _wcslwr (in: _String=0x246f54c | out: _String="ieshims.dll") returned="ieshims.dll" [0060.631] PathFindExtensionW (pszPath="IEShims.dll") returned=".dll" [0060.631] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.631] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.631] PathFindFileNameW (pszPath="iexplore.exe") returned="iexplore.exe" [0060.632] _wcslwr (in: _String=0x246f54c | out: _String="iexplore.exe") returned="iexplore.exe" [0060.632] PathFindExtensionW (pszPath="iexplore.exe") returned=".exe" [0060.632] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.632] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.632] PathFindFileNameW (pszPath="jsdbgui.dll") returned="jsdbgui.dll" [0060.632] _wcslwr (in: _String=0x246f54c | out: _String="jsdbgui.dll") returned="jsdbgui.dll" [0060.632] PathFindExtensionW (pszPath="jsdbgui.dll") returned=".dll" [0060.632] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.632] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.632] PathFindFileNameW (pszPath="jsdebuggeride.dll") returned="jsdebuggeride.dll" [0060.632] _wcslwr (in: _String=0x246f54c | out: _String="jsdebuggeride.dll") returned="jsdebuggeride.dll" [0060.632] PathFindExtensionW (pszPath="jsdebuggeride.dll") returned=".dll" [0060.632] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.632] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.632] PathFindFileNameW (pszPath="JSProfilerCore.dll") returned="JSProfilerCore.dll" [0060.632] _wcslwr (in: _String=0x246f54c | out: _String="jsprofilercore.dll") returned="jsprofilercore.dll" [0060.632] PathFindExtensionW (pszPath="JSProfilerCore.dll") returned=".dll" [0060.632] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.632] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.632] PathFindFileNameW (pszPath="jsprofilerui.dll") returned="jsprofilerui.dll" [0060.632] _wcslwr (in: _String=0x246f54c | out: _String="jsprofilerui.dll") returned="jsprofilerui.dll" [0060.632] PathFindExtensionW (pszPath="jsprofilerui.dll") returned=".dll" [0060.632] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.632] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.633] PathFindFileNameW (pszPath="msdbg2.dll") returned="msdbg2.dll" [0060.633] _wcslwr (in: _String=0x246f54c | out: _String="msdbg2.dll") returned="msdbg2.dll" [0060.633] PathFindExtensionW (pszPath="msdbg2.dll") returned=".dll" [0060.633] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.633] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.633] PathFindFileNameW (pszPath="pdm.dll") returned="pdm.dll" [0060.633] _wcslwr (in: _String=0x246f54c | out: _String="pdm.dll") returned="pdm.dll" [0060.633] PathFindExtensionW (pszPath="pdm.dll") returned=".dll" [0060.633] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.633] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.633] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b9c0 [0060.633] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cad8 [0060.633] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x76fa18 [0060.633] lstrcpyW (in: lpString1=0x76cad8, lpString2="C:\\Program Files (x86)\\Internet Explorer\\" | out: lpString1="C:\\Program Files (x86)\\Internet Explorer\\") returned="C:\\Program Files (x86)\\Internet Explorer\\" [0060.633] lstrcpyW (in: lpString1=0x76fa18, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.633] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Internet Explorer\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\") returned="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\" [0060.633] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\!!_FILES_ENCRYPTED_.txt" [0060.633] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763370 [0060.633] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766720 [0060.633] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763358 [0060.633] PathFindFileNameW (pszPath="sqmapi.dll") returned="sqmapi.dll" [0060.633] _wcslwr (in: _String=0x246f54c | out: _String="sqmapi.dll") returned="sqmapi.dll" [0060.633] PathFindExtensionW (pszPath="sqmapi.dll") returned=".dll" [0060.633] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.633] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.633] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.637] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.637] LocalFree (hMem=0x758e50) returned 0x0 [0060.637] NtClose (Handle=0x7c) returned 0x0 [0060.637] LocalFree (hMem=0x766610) returned 0x0 [0060.637] LocalFree (hMem=0x767430) returned 0x0 [0060.637] LocalFree (hMem=0x7633b8) returned 0x0 [0060.638] LocalFree (hMem=0x7633d0) returned 0x0 [0060.638] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Java\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0060.638] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.638] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.638] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.638] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.638] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.638] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.638] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.638] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.638] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.639] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.639] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.640] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.640] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.640] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.640] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.640] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.640] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.640] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.640] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.640] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.640] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.640] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.640] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.641] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.641] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.642] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.642] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.642] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.642] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.642] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.643] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.643] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.643] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.643] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.644] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.644] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.644] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.644] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.644] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.644] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.645] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.645] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.646] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.646] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.646] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.646] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.646] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.646] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.647] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.647] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.647] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.647] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.648] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.648] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.648] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.649] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.649] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.649] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.649] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.649] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.649] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.650] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.650] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.650] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.651] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.651] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.651] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.651] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.651] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.651] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.652] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.652] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.652] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.653] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.653] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.653] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.653] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.653] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.653] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.654] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.654] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.655] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.655] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.655] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.655] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.655] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.656] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.656] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.656] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.656] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.657] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.657] RtlUpcaseUnicodeChar (Source=0x4a) returned 0x4a [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.657] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.657] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764250 [0060.657] wsprintfW (in: param_1=0x764250, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Java\\") returned 32 [0060.657] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Java\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Java\\") [0060.657] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Java\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.658] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.658] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.658] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.658] PathFindFileNameW (pszPath="ar suzuki.exe") returned="ar suzuki.exe" [0060.658] _wcslwr (in: _String=0x246f54c | out: _String="ar suzuki.exe") returned="ar suzuki.exe" [0060.658] PathFindExtensionW (pszPath="ar suzuki.exe") returned=".exe" [0060.658] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.658] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.658] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76b9f8 [0060.658] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x768178 [0060.658] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fad0 [0060.658] lstrcpyW (in: lpString1=0x768178, lpString2="C:\\Program Files (x86)\\Java\\" | out: lpString1="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0060.659] lstrcpyW (in: lpString1=0x76fad0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.659] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Java\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Java\\") returned="\\\\?\\C:\\Program Files (x86)\\Java\\" [0060.659] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Java\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Java\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Java\\!!_FILES_ENCRYPTED_.txt" [0060.659] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7633d0 [0060.659] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7641e8 [0060.659] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7633b8 [0060.659] PathFindFileNameW (pszPath="remix.exe") returned="remix.exe" [0060.659] _wcslwr (in: _String=0x246f54c | out: _String="remix.exe") returned="remix.exe" [0060.659] PathFindExtensionW (pszPath="remix.exe") returned=".exe" [0060.659] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.659] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.659] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.659] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.659] LocalFree (hMem=0x758e50) returned 0x0 [0060.659] NtClose (Handle=0x7c) returned 0x0 [0060.659] LocalFree (hMem=0x764250) returned 0x0 [0060.659] LocalFree (hMem=0x767500) returned 0x0 [0060.659] LocalFree (hMem=0x7633e8) returned 0x0 [0060.659] LocalFree (hMem=0x763400) returned 0x0 [0060.660] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Microsoft Analysis Services\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0060.660] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fb68 [0060.660] wsprintfW (in: param_1=0x76fb68, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned 55 [0060.660] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Microsoft Analysis Services\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Microsoft Analysis Services\\") [0060.660] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Microsoft Analysis Services\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.660] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.660] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.660] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.660] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76ba30 [0060.660] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766610 [0060.660] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x76fc00 [0060.660] lstrcpyW (in: lpString1=0x766610, lpString2="C:\\Program Files (x86)\\Microsoft Analysis Services\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0060.660] lstrcpyW (in: lpString1=0x76fc00, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.660] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft Analysis Services\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0060.660] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\!!_FILES_ENCRYPTED_.txt" [0060.661] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763400 [0060.661] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fcc8 [0060.661] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7633e8 [0060.661] PathFindFileNameW (pszPath="nomination_constitutes_climbing.exe") returned="nomination_constitutes_climbing.exe" [0060.661] _wcslwr (in: _String=0x246f54c | out: _String="nomination_constitutes_climbing.exe") returned="nomination_constitutes_climbing.exe" [0060.661] PathFindExtensionW (pszPath="nomination_constitutes_climbing.exe") returned=".exe" [0060.661] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.661] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.661] PathFindFileNameW (pszPath="notepad.exe") returned="notepad.exe" [0060.661] _wcslwr (in: _String=0x246f54c | out: _String="notepad.exe") returned="notepad.exe" [0060.661] PathFindExtensionW (pszPath="notepad.exe") returned=".exe" [0060.661] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.661] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.661] PathFindFileNameW (pszPath="totalcmd.exe") returned="totalcmd.exe" [0060.661] _wcslwr (in: _String=0x246f54c | out: _String="totalcmd.exe") returned="totalcmd.exe" [0060.661] PathFindExtensionW (pszPath="totalcmd.exe") returned=".exe" [0060.661] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.661] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.661] PathFindFileNameW (pszPath="well-pump-catering.exe") returned="well-pump-catering.exe" [0060.661] _wcslwr (in: _String=0x246f54c | out: _String="well-pump-catering.exe") returned="well-pump-catering.exe" [0060.662] PathFindExtensionW (pszPath="well-pump-catering.exe") returned=".exe" [0060.662] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.662] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.662] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.662] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.662] LocalFree (hMem=0x758e50) returned 0x0 [0060.662] NtClose (Handle=0x7c) returned 0x0 [0060.662] LocalFree (hMem=0x76fb68) returned 0x0 [0060.662] LocalFree (hMem=0x765730) returned 0x0 [0060.662] LocalFree (hMem=0x763418) returned 0x0 [0060.662] LocalFree (hMem=0x763430) returned 0x0 [0060.662] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Microsoft Office\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0060.662] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765730 [0060.662] wsprintfW (in: param_1=0x765730, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Microsoft Office\\") returned 44 [0060.662] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Microsoft Office\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Microsoft Office\\") [0060.662] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Microsoft Office\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.663] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.663] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.663] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.663] PathFindFileNameW (pszPath="coreftp.exe") returned="coreftp.exe" [0060.663] _wcslwr (in: _String=0x246f54c | out: _String="coreftp.exe") returned="coreftp.exe" [0060.663] PathFindExtensionW (pszPath="coreftp.exe") returned=".exe" [0060.663] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.663] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.663] PathFindFileNameW (pszPath="fling.exe") returned="fling.exe" [0060.663] _wcslwr (in: _String=0x246f54c | out: _String="fling.exe") returned="fling.exe" [0060.663] PathFindExtensionW (pszPath="fling.exe") returned=".exe" [0060.663] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.663] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.663] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76ba68 [0060.663] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cb50 [0060.663] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76db50 [0060.664] lstrcpyW (in: lpString1=0x76cb50, lpString2="C:\\Program Files (x86)\\Microsoft Office\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0060.664] lstrcpyW (in: lpString1=0x76db50, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.664] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft Office\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\" [0060.664] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\!!_FILES_ENCRYPTED_.txt" [0060.664] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763430 [0060.664] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7667a8 [0060.664] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763418 [0060.664] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.664] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.664] LocalFree (hMem=0x758e50) returned 0x0 [0060.664] NtClose (Handle=0x7c) returned 0x0 [0060.664] LocalFree (hMem=0x765730) returned 0x0 [0060.664] LocalFree (hMem=0x7685b0) returned 0x0 [0060.664] LocalFree (hMem=0x763448) returned 0x0 [0060.664] LocalFree (hMem=0x763460) returned 0x0 [0060.664] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.664] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fd78 [0060.665] wsprintfW (in: param_1=0x76fd78, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned 53 [0060.665] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") [0060.665] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.665] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.665] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.665] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.665] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76baa0 [0060.665] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765730 [0060.665] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x771d60 [0060.665] lstrcpyW (in: lpString1=0x765730, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.665] lstrcpyW (in: lpString1=0x771d60, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.665] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.665] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\!!_FILES_ENCRYPTED_.txt" [0060.665] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763460 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fe10 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763448 [0060.666] PathFindFileNameW (pszPath="scriptftp.exe") returned="scriptftp.exe" [0060.666] _wcslwr (in: _String=0x246f54c | out: _String="scriptftp.exe") returned="scriptftp.exe" [0060.666] PathFindExtensionW (pszPath="scriptftp.exe") returned=".exe" [0060.666] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.666] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76bad8 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766830 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x771e28 [0060.666] lstrcpyW (in: lpString1=0x766830, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.666] lstrcpyW (in: lpString1=0x771e28, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.666] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.666] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\!!_FILES_ENCRYPTED_.txt" [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a918 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7668b8 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a930 [0060.666] PathFindFileNameW (pszPath="utg2.exe") returned="utg2.exe" [0060.666] _wcslwr (in: _String=0x246f54c | out: _String="utg2.exe") returned="utg2.exe" [0060.666] PathFindExtensionW (pszPath="utg2.exe") returned=".exe" [0060.666] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.666] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76bb10 [0060.666] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766940 [0060.667] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x771ef0 [0060.667] lstrcpyW (in: lpString1=0x766940, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.667] lstrcpyW (in: lpString1=0x771ef0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.667] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0060.667] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\!!_FILES_ENCRYPTED_.txt" [0060.667] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a948 [0060.667] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fea8 [0060.667] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a960 [0060.667] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.667] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.667] LocalFree (hMem=0x758e50) returned 0x0 [0060.667] NtClose (Handle=0x7c) returned 0x0 [0060.667] LocalFree (hMem=0x76fd78) returned 0x0 [0060.667] LocalFree (hMem=0x7658c8) returned 0x0 [0060.667] LocalFree (hMem=0x763478) returned 0x0 [0060.667] LocalFree (hMem=0x763490) returned 0x0 [0060.667] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Microsoft.NET\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0060.667] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cbc8 [0060.667] wsprintfW (in: param_1=0x76cbc8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\") returned 41 [0060.667] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\") [0060.668] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.668] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.668] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.668] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76bb48 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764250 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76dbf8 [0060.669] lstrcpyW (in: lpString1=0x764250, lpString2="C:\\Program Files (x86)\\Microsoft.NET\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0060.669] lstrcpyW (in: lpString1=0x76dbf8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.669] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft.NET\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\" [0060.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\!!_FILES_ENCRYPTED_.txt" [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x763490 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76dca0 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x763478 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76bb80 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764180 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76dd48 [0060.669] lstrcpyW (in: lpString1=0x764180, lpString2="C:\\Program Files (x86)\\Microsoft.NET\\" | out: lpString1="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0060.669] lstrcpyW (in: lpString1=0x76dd48, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.669] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Microsoft.NET\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\" [0060.669] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\!!_FILES_ENCRYPTED_.txt" [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a978 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7658c8 [0060.669] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a990 [0060.669] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.670] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.670] LocalFree (hMem=0x758e50) returned 0x0 [0060.670] NtClose (Handle=0x7c) returned 0x0 [0060.670] LocalFree (hMem=0x76cbc8) returned 0x0 [0060.670] LocalFree (hMem=0x7642b8) returned 0x0 [0060.670] LocalFree (hMem=0x7634a8) returned 0x0 [0060.670] LocalFree (hMem=0x7634c0) returned 0x0 [0060.670] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Mozilla Firefox\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.670] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cbc8 [0060.670] wsprintfW (in: param_1=0x76cbc8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned 43 [0060.670] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Mozilla Firefox\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Mozilla Firefox\\") [0060.670] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Mozilla Firefox\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.670] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.670] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.671] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.672] PathFindFileNameW (pszPath="AccessibleMarshal.dll") returned="AccessibleMarshal.dll" [0060.672] _wcslwr (in: _String=0x246f54c | out: _String="accessiblemarshal.dll") returned="accessiblemarshal.dll" [0060.672] PathFindExtensionW (pszPath="AccessibleMarshal.dll") returned=".dll" [0060.672] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.672] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.672] PathFindFileNameW (pszPath="application.ini") returned="application.ini" [0060.672] _wcslwr (in: _String=0x246f54c | out: _String="application.ini") returned="application.ini" [0060.672] PathFindExtensionW (pszPath="application.ini") returned=".ini" [0060.672] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.672] _wcslwr (in: _String=0x762078 | out: _String="ini") returned="ini" [0060.672] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76bbb8 [0060.672] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cc40 [0060.672] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x771fb8 [0060.672] lstrcpyW (in: lpString1=0x76cc40, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.672] lstrcpyW (in: lpString1=0x771fb8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.672] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.672] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="application.ini" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\application.ini") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\application.ini" [0060.672] PathFindFileNameW (pszPath="breakpadinjector.dll") returned="breakpadinjector.dll" [0060.673] _wcslwr (in: _String=0x246f54c | out: _String="breakpadinjector.dll") returned="breakpadinjector.dll" [0060.673] PathFindExtensionW (pszPath="breakpadinjector.dll") returned=".dll" [0060.673] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.673] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.673] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x76bbf0 [0060.673] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76ccb8 [0060.673] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76ddf0 [0060.673] lstrcpyW (in: lpString1=0x76ccb8, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.673] lstrcpyW (in: lpString1=0x76ddf0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.673] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.673] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt" [0060.673] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7634c0 [0060.673] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x7669c8 [0060.673] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7634a8 [0060.673] PathFindFileNameW (pszPath="crashreporter.exe") returned="crashreporter.exe" [0060.673] _wcslwr (in: _String=0x246f54c | out: _String="crashreporter.exe") returned="crashreporter.exe" [0060.673] PathFindExtensionW (pszPath="crashreporter.exe") returned=".exe" [0060.673] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.673] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.673] PathFindFileNameW (pszPath="crashreporter.ini") returned="crashreporter.ini" [0060.673] _wcslwr (in: _String=0x246f54c | out: _String="crashreporter.ini") returned="crashreporter.ini" [0060.673] PathFindExtensionW (pszPath="crashreporter.ini") returned=".ini" [0060.673] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.673] _wcslwr (in: _String=0x762078 | out: _String="ini") returned="ini" [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772088 [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cd30 [0060.674] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x772870 [0060.674] lstrcpyW (in: lpString1=0x76cd30, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.674] lstrcpyW (in: lpString1=0x772870, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.674] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.674] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="crashreporter.ini" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini" [0060.674] PathFindFileNameW (pszPath="D3DCompiler_43.dll") returned="D3DCompiler_43.dll" [0060.674] _wcslwr (in: _String=0x246f54c | out: _String="d3dcompiler_43.dll") returned="d3dcompiler_43.dll" [0060.674] PathFindExtensionW (pszPath="D3DCompiler_43.dll") returned=".dll" [0060.674] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.674] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7720c0 [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cda8 [0060.674] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76de98 [0060.674] lstrcpyW (in: lpString1=0x76cda8, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.674] lstrcpyW (in: lpString1=0x76de98, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.674] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.674] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt" [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x76a9a8 [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766a50 [0060.674] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x76a9c0 [0060.674] PathFindFileNameW (pszPath="dependentlibs.list") returned="dependentlibs.list" [0060.674] _wcslwr (in: _String=0x246f54c | out: _String="dependentlibs.list") returned="dependentlibs.list" [0060.674] PathFindExtensionW (pszPath="dependentlibs.list") returned=".list" [0060.674] lstrcatW (in: lpString1="", lpString2="list" | out: lpString1="list") returned="list" [0060.674] _wcslwr (in: _String=0x762078 | out: _String="list") returned="list" [0060.674] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7720f8 [0060.675] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76ce20 [0060.675] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x772938 [0060.675] lstrcpyW (in: lpString1=0x76ce20, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.675] lstrcpyW (in: lpString1=0x772938, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.675] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.675] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="dependentlibs.list" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list" [0060.675] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772130 [0060.675] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76ce98 [0060.675] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76df40 [0060.675] lstrcpyW (in: lpString1=0x76ce98, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.675] lstrcpyW (in: lpString1=0x76df40, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.675] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.675] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt" [0060.675] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x756f90 [0060.675] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766ad8 [0060.675] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x756fa8 [0060.675] PathFindFileNameW (pszPath="firefox.exe") returned="firefox.exe" [0060.675] _wcslwr (in: _String=0x246f54c | out: _String="firefox.exe") returned="firefox.exe" [0060.675] PathFindExtensionW (pszPath="firefox.exe") returned=".exe" [0060.675] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.675] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.675] PathFindFileNameW (pszPath="freebl3.chk") returned="freebl3.chk" [0060.675] _wcslwr (in: _String=0x246f54c | out: _String="freebl3.chk") returned="freebl3.chk" [0060.675] PathFindExtensionW (pszPath="freebl3.chk") returned=".chk" [0060.675] lstrcatW (in: lpString1="", lpString2="chk" | out: lpString1="chk") returned="chk" [0060.675] _wcslwr (in: _String=0x762078 | out: _String="chk") returned="chk" [0060.676] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772168 [0060.676] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cf10 [0060.676] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76dfe8 [0060.676] lstrcpyW (in: lpString1=0x76cf10, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.676] lstrcpyW (in: lpString1=0x76dfe8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.676] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.676] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="freebl3.chk" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk" [0060.676] PathFindFileNameW (pszPath="freebl3.dll") returned="freebl3.dll" [0060.676] _wcslwr (in: _String=0x246f54c | out: _String="freebl3.dll") returned="freebl3.dll" [0060.676] PathFindExtensionW (pszPath="freebl3.dll") returned=".dll" [0060.676] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.676] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.676] PathFindFileNameW (pszPath="gkmedias.dll") returned="gkmedias.dll" [0060.676] _wcslwr (in: _String=0x246f54c | out: _String="gkmedias.dll") returned="gkmedias.dll" [0060.676] PathFindExtensionW (pszPath="gkmedias.dll") returned=".dll" [0060.676] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.676] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.676] PathFindFileNameW (pszPath="install.log") returned="install.log" [0060.676] _wcslwr (in: _String=0x246f54c | out: _String="install.log") returned="install.log" [0060.676] PathFindExtensionW (pszPath="install.log") returned=".log" [0060.676] lstrcatW (in: lpString1="", lpString2="log" | out: lpString1="log") returned="log" [0060.676] _wcslwr (in: _String=0x762078 | out: _String="log") returned="log" [0060.677] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7721a0 [0060.677] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cf88 [0060.677] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e090 [0060.677] lstrcpyW (in: lpString1=0x76cf88, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.677] lstrcpyW (in: lpString1=0x76e090, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.677] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.677] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="install.log" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\install.log") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\install.log" [0060.677] PathFindFileNameW (pszPath="libEGL.dll") returned="libEGL.dll" [0060.677] _wcslwr (in: _String=0x246f54c | out: _String="libegl.dll") returned="libegl.dll" [0060.677] PathFindExtensionW (pszPath="libEGL.dll") returned=".dll" [0060.677] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.677] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.677] PathFindFileNameW (pszPath="libGLESv2.dll") returned="libGLESv2.dll" [0060.677] _wcslwr (in: _String=0x246f54c | out: _String="libglesv2.dll") returned="libglesv2.dll" [0060.677] PathFindExtensionW (pszPath="libGLESv2.dll") returned=".dll" [0060.677] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.677] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.677] PathFindFileNameW (pszPath="maintenanceservice.exe") returned="maintenanceservice.exe" [0060.677] _wcslwr (in: _String=0x246f54c | out: _String="maintenanceservice.exe") returned="maintenanceservice.exe" [0060.677] PathFindExtensionW (pszPath="maintenanceservice.exe") returned=".exe" [0060.677] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.678] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.678] PathFindFileNameW (pszPath="maintenanceservice_installer.exe") returned="maintenanceservice_installer.exe" [0060.678] _wcslwr (in: _String=0x246f54c | out: _String="maintenanceservice_installer.exe") returned="maintenanceservice_installer.exe" [0060.678] PathFindExtensionW (pszPath="maintenanceservice_installer.exe") returned=".exe" [0060.678] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.678] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.678] PathFindFileNameW (pszPath="mozalloc.dll") returned="mozalloc.dll" [0060.678] _wcslwr (in: _String=0x246f54c | out: _String="mozalloc.dll") returned="mozalloc.dll" [0060.678] PathFindExtensionW (pszPath="mozalloc.dll") returned=".dll" [0060.678] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.678] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.678] PathFindFileNameW (pszPath="mozglue.dll") returned="mozglue.dll" [0060.678] _wcslwr (in: _String=0x246f54c | out: _String="mozglue.dll") returned="mozglue.dll" [0060.678] PathFindExtensionW (pszPath="mozglue.dll") returned=".dll" [0060.678] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.678] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.678] PathFindFileNameW (pszPath="mozjs.dll") returned="mozjs.dll" [0060.678] _wcslwr (in: _String=0x246f54c | out: _String="mozjs.dll") returned="mozjs.dll" [0060.678] PathFindExtensionW (pszPath="mozjs.dll") returned=".dll" [0060.678] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.678] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.678] PathFindFileNameW (pszPath="msvcp100.dll") returned="msvcp100.dll" [0060.678] _wcslwr (in: _String=0x246f54c | out: _String="msvcp100.dll") returned="msvcp100.dll" [0060.679] PathFindExtensionW (pszPath="msvcp100.dll") returned=".dll" [0060.679] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.679] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.679] PathFindFileNameW (pszPath="msvcr100.dll") returned="msvcr100.dll" [0060.679] _wcslwr (in: _String=0x246f54c | out: _String="msvcr100.dll") returned="msvcr100.dll" [0060.679] PathFindExtensionW (pszPath="msvcr100.dll") returned=".dll" [0060.679] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.679] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.679] PathFindFileNameW (pszPath="nss3.dll") returned="nss3.dll" [0060.679] _wcslwr (in: _String=0x246f54c | out: _String="nss3.dll") returned="nss3.dll" [0060.679] PathFindExtensionW (pszPath="nss3.dll") returned=".dll" [0060.679] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.679] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.679] PathFindFileNameW (pszPath="nssckbi.dll") returned="nssckbi.dll" [0060.679] _wcslwr (in: _String=0x246f54c | out: _String="nssckbi.dll") returned="nssckbi.dll" [0060.679] PathFindExtensionW (pszPath="nssckbi.dll") returned=".dll" [0060.679] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.679] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.679] PathFindFileNameW (pszPath="nssdbm3.chk") returned="nssdbm3.chk" [0060.679] _wcslwr (in: _String=0x246f54c | out: _String="nssdbm3.chk") returned="nssdbm3.chk" [0060.679] PathFindExtensionW (pszPath="nssdbm3.chk") returned=".chk" [0060.679] lstrcatW (in: lpString1="", lpString2="chk" | out: lpString1="chk") returned="chk" [0060.679] _wcslwr (in: _String=0x762078 | out: _String="chk") returned="chk" [0060.679] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7721d8 [0060.680] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d000 [0060.680] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e138 [0060.680] lstrcpyW (in: lpString1=0x76d000, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.680] lstrcpyW (in: lpString1=0x76e138, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.680] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.680] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="nssdbm3.chk" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk" [0060.680] PathFindFileNameW (pszPath="nssdbm3.dll") returned="nssdbm3.dll" [0060.680] _wcslwr (in: _String=0x246f54c | out: _String="nssdbm3.dll") returned="nssdbm3.dll" [0060.680] PathFindExtensionW (pszPath="nssdbm3.dll") returned=".dll" [0060.680] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.680] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.680] PathFindFileNameW (pszPath="omni.ja") returned="omni.ja" [0060.680] _wcslwr (in: _String=0x246f54c | out: _String="omni.ja") returned="omni.ja" [0060.680] PathFindExtensionW (pszPath="omni.ja") returned=".ja" [0060.680] lstrcatW (in: lpString1="", lpString2="ja" | out: lpString1="ja") returned="ja" [0060.680] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772210 [0060.680] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d078 [0060.680] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76fd78 [0060.680] lstrcpyW (in: lpString1=0x76d078, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.680] lstrcpyW (in: lpString1=0x76fd78, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.680] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.681] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="omni.ja" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja" [0060.681] PathFindFileNameW (pszPath="platform.ini") returned="platform.ini" [0060.681] PathFindExtensionW (pszPath="platform.ini") returned=".ini" [0060.681] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.681] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772248 [0060.681] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d0f0 [0060.681] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x772a00 [0060.681] lstrcpyW (in: lpString1=0x76d0f0, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.681] lstrcpyW (in: lpString1=0x772a00, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.681] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.681] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="platform.ini" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini" [0060.681] PathFindFileNameW (pszPath="plugin-container.exe") returned="plugin-container.exe" [0060.681] PathFindExtensionW (pszPath="plugin-container.exe") returned=".exe" [0060.681] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.681] PathFindFileNameW (pszPath="plugin-hang-ui.exe") returned="plugin-hang-ui.exe" [0060.681] PathFindExtensionW (pszPath="plugin-hang-ui.exe") returned=".exe" [0060.681] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.682] PathFindFileNameW (pszPath="precomplete") returned="precomplete" [0060.682] PathFindExtensionW (pszPath="precomplete") returned="" [0060.682] lstrcatW (in: lpString1="", lpString2="" | out: lpString1="") returned="" [0060.682] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772280 [0060.682] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d168 [0060.682] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e1e0 [0060.682] lstrcpyW (in: lpString1=0x76d168, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.682] lstrcpyW (in: lpString1=0x76e1e0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.682] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.682] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="precomplete" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\precomplete") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\precomplete" [0060.682] PathFindFileNameW (pszPath="removed-files") returned="removed-files" [0060.682] PathFindExtensionW (pszPath="removed-files") returned="" [0060.682] lstrcatW (in: lpString1="", lpString2="" | out: lpString1="") returned="" [0060.682] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7722b8 [0060.682] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d1e0 [0060.682] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x772ab8 [0060.682] lstrcpyW (in: lpString1=0x76d1e0, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.682] lstrcpyW (in: lpString1=0x772ab8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.683] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="removed-files" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\removed-files") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\removed-files" [0060.683] PathFindFileNameW (pszPath="softokn3.chk") returned="softokn3.chk" [0060.683] PathFindExtensionW (pszPath="softokn3.chk") returned=".chk" [0060.683] lstrcatW (in: lpString1="", lpString2="chk" | out: lpString1="chk") returned="chk" [0060.683] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7722f0 [0060.683] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d258 [0060.683] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x772b70 [0060.683] lstrcpyW (in: lpString1=0x76d258, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.683] lstrcpyW (in: lpString1=0x772b70, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.683] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.683] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="softokn3.chk" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk" [0060.683] PathFindFileNameW (pszPath="softokn3.dll") returned="softokn3.dll" [0060.683] PathFindExtensionW (pszPath="softokn3.dll") returned=".dll" [0060.683] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.683] PathFindFileNameW (pszPath="staticbiologicalmile.exe") returned="staticbiologicalmile.exe" [0060.684] PathFindExtensionW (pszPath="staticbiologicalmile.exe") returned=".exe" [0060.684] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.684] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772328 [0060.684] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d2d0 [0060.684] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e288 [0060.684] lstrcpyW (in: lpString1=0x76d2d0, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.684] lstrcpyW (in: lpString1=0x76e288, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.684] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.684] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt" [0060.684] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x772c40 [0060.684] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766b60 [0060.684] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x772c58 [0060.684] PathFindFileNameW (pszPath="update-settings.ini") returned="update-settings.ini" [0060.685] PathFindExtensionW (pszPath="update-settings.ini") returned=".ini" [0060.685] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.685] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772360 [0060.685] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76d348 [0060.685] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x773028 [0060.685] lstrcpyW (in: lpString1=0x76d348, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.685] lstrcpyW (in: lpString1=0x773028, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.685] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.685] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="update-settings.ini" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini" [0060.685] PathFindFileNameW (pszPath="updater.exe") returned="updater.exe" [0060.685] PathFindExtensionW (pszPath="updater.exe") returned=".exe" [0060.685] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.685] PathFindFileNameW (pszPath="updater.ini") returned="updater.ini" [0060.685] PathFindExtensionW (pszPath="updater.ini") returned=".ini" [0060.685] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.685] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772398 [0060.685] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x773108 [0060.686] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e330 [0060.686] lstrcpyW (in: lpString1=0x773108, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.686] lstrcpyW (in: lpString1=0x76e330, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.686] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.686] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="updater.ini" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini" [0060.686] PathFindFileNameW (pszPath="watched.exe") returned="watched.exe" [0060.686] PathFindExtensionW (pszPath="watched.exe") returned=".exe" [0060.686] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.686] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.686] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.686] PathFindFileNameW (pszPath="webapp-uninstaller.exe") returned="webapp-uninstaller.exe" [0060.686] PathFindExtensionW (pszPath="webapp-uninstaller.exe") returned=".exe" [0060.686] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.686] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7723d0 [0060.686] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x773180 [0060.686] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e3d8 [0060.687] lstrcpyW (in: lpString1=0x773180, lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Firefox\\") returned="C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.687] lstrcpyW (in: lpString1=0x76e3d8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.687] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Firefox\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\" [0060.687] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\!!_FILES_ENCRYPTED_.txt" [0060.687] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x772c70 [0060.687] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766be8 [0060.687] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x772c88 [0060.687] PathFindFileNameW (pszPath="webapprt-stub.exe") returned="webapprt-stub.exe" [0060.687] PathFindExtensionW (pszPath="webapprt-stub.exe") returned=".exe" [0060.687] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.687] PathFindFileNameW (pszPath="xul.dll") returned="xul.dll" [0060.687] PathFindExtensionW (pszPath="xul.dll") returned=".dll" [0060.687] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.687] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.687] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.688] LocalFree (hMem=0x758e50) returned 0x0 [0060.688] NtClose (Handle=0x7c) returned 0x0 [0060.688] LocalFree (hMem=0x76cbc8) returned 0x0 [0060.688] LocalFree (hMem=0x768a28) returned 0x0 [0060.688] LocalFree (hMem=0x768640) returned 0x0 [0060.688] LocalFree (hMem=0x768658) returned 0x0 [0060.688] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Mozilla Maintenance Service\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service\\" [0060.688] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.688] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.688] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.688] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.688] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.688] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.688] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.688] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.688] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.689] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.689] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.690] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.690] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.691] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.691] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.691] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.692] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.692] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.692] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.692] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.692] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.692] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.692] RtlUpcaseUnicodeChar (Source=0x24) returned 0x24 [0060.692] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.692] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.692] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.693] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.693] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.694] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.694] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.695] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.695] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.696] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.696] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.696] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.696] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.697] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.697] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.697] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.697] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.698] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.698] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.699] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.699] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.699] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.699] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.699] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.699] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.700] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.701] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.701] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.701] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.701] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x76) returned 0x56 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x0) returned 0x0 [0060.702] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.702] RtlUpcaseUnicodeChar (Source=0x43) returned 0x43 [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.702] RtlUpcaseUnicodeChar (Source=0x3a) returned 0x3a [0060.702] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.703] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.703] RtlUpcaseUnicodeChar (Source=0x50) returned 0x50 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x67) returned 0x47 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x72) returned 0x52 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x6d) returned 0x4d [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x46) returned 0x46 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.703] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.703] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x73) returned 0x53 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x28) returned 0x28 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x78) returned 0x58 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x38) returned 0x38 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x36) returned 0x36 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x29) returned 0x29 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.704] RtlUpcaseUnicodeChar (Source=0x77) returned 0x57 [0060.704] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x6f) returned 0x4f [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x7a) returned 0x5a [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.704] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.704] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x6c) returned 0x4c [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x4d) returned 0x4d [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x69) returned 0x49 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x74) returned 0x54 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x61) returned 0x41 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x6e) returned 0x4e [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x63) returned 0x43 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.705] RtlUpcaseUnicodeChar (Source=0x20) returned 0x20 [0060.705] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.706] RtlUpcaseUnicodeChar (Source=0x53) returned 0x53 [0060.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.706] RtlUpcaseUnicodeChar (Source=0x65) returned 0x45 [0060.706] RtlUpcaseUnicodeChar (Source=0x5c) returned 0x5c [0060.706] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76ff40 [0060.706] wsprintfW (in: param_1=0x76ff40, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\") returned 55 [0060.706] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\") [0060.706] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.706] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.706] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.706] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.707] PathFindFileNameW (pszPath="active-charge.exe") returned="active-charge.exe" [0060.707] _wcslwr (in: _String=0x246f54c | out: _String="active-charge.exe") returned="active-charge.exe" [0060.707] PathFindExtensionW (pszPath="active-charge.exe") returned=".exe" [0060.707] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.707] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.707] PathFindFileNameW (pszPath="maintenanceservice.exe") returned="maintenanceservice.exe" [0060.707] _wcslwr (in: _String=0x246f54c | out: _String="maintenanceservice.exe") returned="maintenanceservice.exe" [0060.707] PathFindExtensionW (pszPath="maintenanceservice.exe") returned=".exe" [0060.707] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.707] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.707] PathFindFileNameW (pszPath="smartftp.exe") returned="smartftp.exe" [0060.707] _wcslwr (in: _String=0x246f54c | out: _String="smartftp.exe") returned="smartftp.exe" [0060.707] PathFindExtensionW (pszPath="smartftp.exe") returned=".exe" [0060.707] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.707] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.707] PathFindFileNameW (pszPath="Uninstall.exe") returned="Uninstall.exe" [0060.707] _wcslwr (in: _String=0x246f54c | out: _String="uninstall.exe") returned="uninstall.exe" [0060.707] PathFindExtensionW (pszPath="Uninstall.exe") returned=".exe" [0060.707] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.707] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.707] PathFindFileNameW (pszPath="updater.ini") returned="updater.ini" [0060.707] _wcslwr (in: _String=0x246f54c | out: _String="updater.ini") returned="updater.ini" [0060.707] PathFindExtensionW (pszPath="updater.ini") returned=".ini" [0060.708] lstrcatW (in: lpString1="", lpString2="ini" | out: lpString1="ini") returned="ini" [0060.708] _wcslwr (in: _String=0x762078 | out: _String="ini") returned="ini" [0060.708] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772408 [0060.708] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766c70 [0060.708] LocalAlloc (uFlags=0x40, uBytes=0xc0) returned 0x7740f0 [0060.708] lstrcpyW (in: lpString1=0x766c70, lpString2="C:\\Program Files (x86)\\Mozilla Maintenance Service\\" | out: lpString1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service\\" [0060.708] lstrcpyW (in: lpString1=0x7740f0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.708] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Mozilla Maintenance Service\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\" [0060.708] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\", lpString2="updater.ini" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini") returned="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini" [0060.708] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.708] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.708] LocalFree (hMem=0x758e50) returned 0x0 [0060.709] NtClose (Handle=0x7c) returned 0x0 [0060.709] LocalFree (hMem=0x76ff40) returned 0x0 [0060.709] LocalFree (hMem=0x765ae8) returned 0x0 [0060.709] LocalFree (hMem=0x768670) returned 0x0 [0060.709] LocalFree (hMem=0x768688) returned 0x0 [0060.709] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\MSBuild\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0060.709] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x7642b8 [0060.709] wsprintfW (in: param_1=0x7642b8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\MSBuild\\") returned 35 [0060.709] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\MSBuild\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\MSBuild\\") [0060.709] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\MSBuild\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.709] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.709] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.710] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772440 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764ba8 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76ff40 [0060.710] lstrcpyW (in: lpString1=0x764ba8, lpString2="C:\\Program Files (x86)\\MSBuild\\" | out: lpString1="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0060.710] lstrcpyW (in: lpString1=0x76ff40, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.710] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\MSBuild\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\MSBuild\\") returned="\\\\?\\C:\\Program Files (x86)\\MSBuild\\" [0060.710] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\MSBuild\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\MSBuild\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\MSBuild\\!!_FILES_ENCRYPTED_.txt" [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768688 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x76cbc8 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768670 [0060.710] PathFindFileNameW (pszPath="Microsoft.Office.InfoPath.targets") returned="Microsoft.Office.InfoPath.targets" [0060.710] _wcslwr (in: _String=0x246f54c | out: _String="microsoft.office.infopath.targets") returned="microsoft.office.infopath.targets" [0060.710] PathFindExtensionW (pszPath="Microsoft.Office.InfoPath.targets") returned=".targets" [0060.710] lstrcatW (in: lpString1="", lpString2="targets" | out: lpString1="targets") returned="targets" [0060.710] _wcslwr (in: _String=0x762078 | out: _String="targets") returned="targets" [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772478 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764c10 [0060.710] LocalAlloc (uFlags=0x40, uBytes=0xf0) returned 0x7741b8 [0060.710] lstrcpyW (in: lpString1=0x764c10, lpString2="C:\\Program Files (x86)\\MSBuild\\" | out: lpString1="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0060.710] lstrcpyW (in: lpString1=0x7741b8, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.710] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\MSBuild\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\MSBuild\\") returned="\\\\?\\C:\\Program Files (x86)\\MSBuild\\" [0060.711] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\MSBuild\\", lpString2="Microsoft.Office.InfoPath.targets" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets") returned="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" [0060.711] PathFindFileNameW (pszPath="winscp.exe") returned="winscp.exe" [0060.711] _wcslwr (in: _String=0x246f54c | out: _String="winscp.exe") returned="winscp.exe" [0060.711] PathFindExtensionW (pszPath="winscp.exe") returned=".exe" [0060.711] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.711] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.711] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.711] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.711] LocalFree (hMem=0x758e50) returned 0x0 [0060.711] NtClose (Handle=0x7c) returned 0x0 [0060.711] LocalFree (hMem=0x7642b8) returned 0x0 [0060.711] LocalFree (hMem=0x764320) returned 0x0 [0060.711] LocalFree (hMem=0x7686a0) returned 0x0 [0060.711] LocalFree (hMem=0x7686b8) returned 0x0 [0060.711] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Reference Assemblies\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0060.711] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765ae8 [0060.711] wsprintfW (in: param_1=0x765ae8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\") returned 48 [0060.711] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\") [0060.712] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.712] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.712] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.713] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.713] PathFindFileNameW (pszPath="cod_lebanon_exams.exe") returned="cod_lebanon_exams.exe" [0060.713] _wcslwr (in: _String=0x246f54c | out: _String="cod_lebanon_exams.exe") returned="cod_lebanon_exams.exe" [0060.713] PathFindExtensionW (pszPath="cod_lebanon_exams.exe") returned=".exe" [0060.713] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.713] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.713] PathFindFileNameW (pszPath="guaranteed.exe") returned="guaranteed.exe" [0060.713] _wcslwr (in: _String=0x246f54c | out: _String="guaranteed.exe") returned="guaranteed.exe" [0060.713] PathFindExtensionW (pszPath="guaranteed.exe") returned=".exe" [0060.713] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.713] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.713] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7724b0 [0060.713] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7731f8 [0060.713] LocalAlloc (uFlags=0x40, uBytes=0xb0) returned 0x7742b0 [0060.713] lstrcpyW (in: lpString1=0x7731f8, lpString2="C:\\Program Files (x86)\\Reference Assemblies\\" | out: lpString1="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0060.713] lstrcpyW (in: lpString1=0x7742b0, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.713] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Reference Assemblies\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\") returned="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\" [0060.714] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\!!_FILES_ENCRYPTED_.txt" [0060.714] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7686b8 [0060.714] LocalAlloc (uFlags=0x40, uBytes=0x90) returned 0x76ffd8 [0060.714] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x7686a0 [0060.714] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.714] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.714] LocalFree (hMem=0x758e50) returned 0x0 [0060.714] NtClose (Handle=0x7c) returned 0x0 [0060.714] LocalFree (hMem=0x765ae8) returned 0x0 [0060.714] LocalFree (hMem=0x768aa0) returned 0x0 [0060.714] LocalFree (hMem=0x7686d0) returned 0x0 [0060.714] LocalFree (hMem=0x7686e8) returned 0x0 [0060.714] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Uninstall Information\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Uninstall Information\\") returned="C:\\Program Files (x86)\\Uninstall Information\\" [0060.714] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765ae8 [0060.714] wsprintfW (in: param_1=0x765ae8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Uninstall Information\\") returned 49 [0060.714] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Uninstall Information\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Uninstall Information\\") [0060.714] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Uninstall Information\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.715] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.715] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.715] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.715] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.716] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.716] LocalFree (hMem=0x758e50) returned 0x0 [0060.716] NtClose (Handle=0x7c) returned 0x0 [0060.716] LocalFree (hMem=0x765ae8) returned 0x0 [0060.716] LocalFree (hMem=0x768b18) returned 0x0 [0060.716] LocalFree (hMem=0x768700) returned 0x0 [0060.716] LocalFree (hMem=0x768718) returned 0x0 [0060.716] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Windows Defender\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Windows Defender\\") returned="C:\\Program Files (x86)\\Windows Defender\\" [0060.716] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765ae8 [0060.716] wsprintfW (in: param_1=0x765ae8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Windows Defender\\") returned 44 [0060.716] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Windows Defender\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Windows Defender\\") [0060.716] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Windows Defender\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.716] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.716] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.717] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.717] PathFindFileNameW (pszPath="3dftp.exe") returned="3dftp.exe" [0060.717] _wcslwr (in: _String=0x246f54c | out: _String="3dftp.exe") returned="3dftp.exe" [0060.717] PathFindExtensionW (pszPath="3dftp.exe") returned=".exe" [0060.717] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.717] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.717] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x7724e8 [0060.717] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x773270 [0060.717] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e480 [0060.717] lstrcpyW (in: lpString1=0x773270, lpString2="C:\\Program Files (x86)\\Windows Defender\\" | out: lpString1="C:\\Program Files (x86)\\Windows Defender\\") returned="C:\\Program Files (x86)\\Windows Defender\\" [0060.717] lstrcpyW (in: lpString1=0x76e480, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.717] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Windows Defender\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\") returned="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\" [0060.717] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\!!_FILES_ENCRYPTED_.txt" [0060.717] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768718 [0060.717] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x766cf8 [0060.717] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768700 [0060.717] PathFindFileNameW (pszPath="featuring.exe") returned="featuring.exe" [0060.717] _wcslwr (in: _String=0x246f54c | out: _String="featuring.exe") returned="featuring.exe" [0060.717] PathFindExtensionW (pszPath="featuring.exe") returned=".exe" [0060.717] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.718] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.718] PathFindFileNameW (pszPath="MpAsDesc.dll") returned="MpAsDesc.dll" [0060.718] _wcslwr (in: _String=0x246f54c | out: _String="mpasdesc.dll") returned="mpasdesc.dll" [0060.718] PathFindExtensionW (pszPath="MpAsDesc.dll") returned=".dll" [0060.718] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.718] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.718] PathFindFileNameW (pszPath="MpClient.dll") returned="MpClient.dll" [0060.718] _wcslwr (in: _String=0x246f54c | out: _String="mpclient.dll") returned="mpclient.dll" [0060.718] PathFindExtensionW (pszPath="MpClient.dll") returned=".dll" [0060.718] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.718] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.718] PathFindFileNameW (pszPath="MpOAV.dll") returned="MpOAV.dll" [0060.718] _wcslwr (in: _String=0x246f54c | out: _String="mpoav.dll") returned="mpoav.dll" [0060.718] PathFindExtensionW (pszPath="MpOAV.dll") returned=".dll" [0060.718] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.718] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.718] PathFindFileNameW (pszPath="MsMpLics.dll") returned="MsMpLics.dll" [0060.718] _wcslwr (in: _String=0x246f54c | out: _String="msmplics.dll") returned="msmplics.dll" [0060.718] PathFindExtensionW (pszPath="MsMpLics.dll") returned=".dll" [0060.718] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.718] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.718] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.719] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.719] LocalFree (hMem=0x758e50) returned 0x0 [0060.719] NtClose (Handle=0x7c) returned 0x0 [0060.719] LocalFree (hMem=0x765ae8) returned 0x0 [0060.719] LocalFree (hMem=0x768b90) returned 0x0 [0060.719] LocalFree (hMem=0x768730) returned 0x0 [0060.719] LocalFree (hMem=0x768748) returned 0x0 [0060.719] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Windows Mail\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0060.719] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x7732e8 [0060.719] wsprintfW (in: param_1=0x7732e8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Windows Mail\\") returned 40 [0060.719] RtlInitUnicodeString (in: DestinationString=0x246f774, SourceString="\\??\\C:\\Program Files (x86)\\Windows Mail\\" | out: DestinationString="\\??\\C:\\Program Files (x86)\\Windows Mail\\") [0060.719] NtCreateFile (in: FileHandle=0x246f78c, DesiredAccess=0x80000000, ObjectAttributes=0x246f754*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Program Files (x86)\\Windows Mail\\", Attributes=0xc0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x246f76c, AllocationSize=0x0, FileAttributes=0x10, ShareAccess=0x7, CreateDisposition=0x1, CreateOptions=0x1, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x246f78c*=0x7c, IoStatusBlock=0x246f76c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0060.719] LocalAlloc (uFlags=0x40, uBytes=0x1010) returned 0x758e50 [0060.719] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=1 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.719] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.719] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x772520 [0060.719] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x764320 [0060.720] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x76e528 [0060.720] lstrcpyW (in: lpString1=0x764320, lpString2="C:\\Program Files (x86)\\Windows Mail\\" | out: lpString1="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0060.720] lstrcpyW (in: lpString1=0x76e528, lpString2="\\\\?\\" | out: lpString1="\\\\?\\") returned="\\\\?\\" [0060.720] lstrcatW (in: lpString1="\\\\?\\", lpString2="C:\\Program Files (x86)\\Windows Mail\\" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\") returned="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\" [0060.720] lstrcatW (in: lpString1="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\", lpString2="!!_FILES_ENCRYPTED_.txt" | out: lpString1="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\!!_FILES_ENCRYPTED_.txt") returned="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\!!_FILES_ENCRYPTED_.txt" [0060.720] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x768748 [0060.720] LocalAlloc (uFlags=0x40, uBytes=0x70) returned 0x773360 [0060.720] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x768730 [0060.720] PathFindFileNameW (pszPath="msoe.dll") returned="msoe.dll" [0060.720] _wcslwr (in: _String=0x246f54c | out: _String="msoe.dll") returned="msoe.dll" [0060.720] PathFindExtensionW (pszPath="msoe.dll") returned=".dll" [0060.720] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.720] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.720] PathFindFileNameW (pszPath="MSOERES.dll") returned="MSOERES.dll" [0060.720] _wcslwr (in: _String=0x246f54c | out: _String="msoeres.dll") returned="msoeres.dll" [0060.720] PathFindExtensionW (pszPath="MSOERES.dll") returned=".dll" [0060.720] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.720] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.720] PathFindFileNameW (pszPath="oeimport.dll") returned="oeimport.dll" [0060.720] _wcslwr (in: _String=0x246f54c | out: _String="oeimport.dll") returned="oeimport.dll" [0060.720] PathFindExtensionW (pszPath="oeimport.dll") returned=".dll" [0060.720] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.720] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.720] PathFindFileNameW (pszPath="spgagentservice.exe") returned="spgagentservice.exe" [0060.721] _wcslwr (in: _String=0x246f54c | out: _String="spgagentservice.exe") returned="spgagentservice.exe" [0060.721] PathFindExtensionW (pszPath="spgagentservice.exe") returned=".exe" [0060.721] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.721] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.721] PathFindFileNameW (pszPath="wab.exe") returned="wab.exe" [0060.721] _wcslwr (in: _String=0x246f54c | out: _String="wab.exe") returned="wab.exe" [0060.721] PathFindExtensionW (pszPath="wab.exe") returned=".exe" [0060.721] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.721] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.721] PathFindFileNameW (pszPath="wabfind.dll") returned="wabfind.dll" [0060.721] _wcslwr (in: _String=0x246f54c | out: _String="wabfind.dll") returned="wabfind.dll" [0060.721] PathFindExtensionW (pszPath="wabfind.dll") returned=".dll" [0060.721] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.721] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.721] PathFindFileNameW (pszPath="wabimp.dll") returned="wabimp.dll" [0060.721] _wcslwr (in: _String=0x246f54c | out: _String="wabimp.dll") returned="wabimp.dll" [0060.721] PathFindExtensionW (pszPath="wabimp.dll") returned=".dll" [0060.721] lstrcatW (in: lpString1="", lpString2="dll" | out: lpString1="dll") returned="dll" [0060.721] _wcslwr (in: _String=0x762078 | out: _String="dll") returned="dll" [0060.721] PathFindFileNameW (pszPath="wabmig.exe") returned="wabmig.exe" [0060.721] _wcslwr (in: _String=0x246f54c | out: _String="wabmig.exe") returned="wabmig.exe" [0060.721] PathFindExtensionW (pszPath="wabmig.exe") returned=".exe" [0060.721] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.721] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.721] PathFindFileNameW (pszPath="WinMail.exe") returned="WinMail.exe" [0060.721] _wcslwr (in: _String=0x246f54c | out: _String="winmail.exe") returned="winmail.exe" [0060.722] PathFindExtensionW (pszPath="WinMail.exe") returned=".exe" [0060.722] lstrcatW (in: lpString1="", lpString2="exe" | out: lpString1="exe") returned="exe" [0060.722] _wcslwr (in: _String=0x762078 | out: _String="exe") returned="exe" [0060.722] NtQueryDirectoryFile (in: FileHandle=0x7c, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x246f708, FileInformation=0x758e50, Length=0x1000, FileInformationClass=0x1, ReturnSingleEntry=0, FileName=0x0, RestartScan=0 | out: IoStatusBlock=0x246f708, FileInformation=0x758e50) returned 0x103 [0060.722] NtWaitForSingleObject (Object=0x7c, Alertable=0, Time=0x0) returned 0x0 [0060.722] LocalFree (hMem=0x758e50) returned 0x0 [0060.722] NtClose (Handle=0x7c) returned 0x0 [0060.722] LocalFree (hMem=0x7732e8) returned 0x0 [0060.722] LocalFree (hMem=0x764388) returned 0x0 [0060.722] LocalFree (hMem=0x768760) returned 0x0 [0060.722] LocalFree (hMem=0x768778) returned 0x0 [0060.722] StrCpyNW (in: psz1=0x757544, psz2="C:\\Program Files (x86)\\Windows Media Player\\", cchMax=252 | out: psz1="C:\\Program Files (x86)\\Windows Media Player\\") returned="C:\\Program Files (x86)\\Windows Media Player\\" [0060.722] LocalAlloc (uFlags=0x40, uBytes=0x80) returned 0x765ae8 [0060.722] wsprintfW (in: param_1=0x765ae8, param_2="\\??\\%ws" | out: param_1="\\??\\C:\\Program Files (x86)\\Windows Media Player\\") returne